<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="49112">
<package pkgid="60962e5dcc6e7edf4187dd5aa8db97fb070d97c9dd6ee10f21b8ea7b782fe8eb" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="66f2e0ae0978ab9aff04ccfe89c0b39c86aad2af874924f14718fe0fd5462361" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="871f069ce9d19a7ef549fdd663dd251e1cb0894ca7dd8556c166e89241c0a986" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d9b216d9738b662d40cec6f4636c4e59ac9aa6dabba2563bdf4102972c82a2b9" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="c09300a02834293cbb314212a5128ddccf9710e6473ce849f4b50834c72ce1ca" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="39e5514280088eb6c48ffcae2febcb4917aba329f553b5d0220274af07e1372f" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="65c3bc78714ee0c888f8c0b4474d88219ca0f91d221f98831a107d06c37288eb" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="d84a0d44a29c35a8f7760202400199574529d2005fb6d79fd0254558a0bd4582" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8ddaf45babed9b1081a6add1208ef4e266e6c5b14a313f56bcfa56a92e216a00" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="212a4be3d5235966b00b7c4a1c79adf64214bf38f8d898900604ce473d34903d" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f1682b8fb728a90620033925d4333bb3a803190afcd330352b0f755416c2c215" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="dec209b5fb0e2c8ae1423c01820895a0194b53ab130a6147a2440d236e420594" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="02cd746438f78cfc32e1a9c80e523495e1eed724520fdad11aa9efebb3394b63" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="af8bf15c173353eafd29210613d10c2b7522163be179dd67657e309f0ce0363b" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="c292ea730e6a671dbec3e1ca0339340f1d7709ecb6b3bd9acb7bdaee7427f1e7" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="1dd9b4e1e3704bc6499ae7681ecfabfe46edce01a9f6b80ff3f6848ede7f2dd9" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="f8b10405a03c4c1177f9791017d9582c2e5c1f7da3effce2a1e2fbbc73e6270f" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b129859e7252e4341185e260764ca2e78cbc6a5adf52a7eb7684046bc9115727" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="ac938da1ecea750c7ad52ca03a355b41e37612264770cf3a7ca9e81b0b2a4ff9" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="15bbf9f4cdbd0f9b36071bb99e80a0835f6e98b02587f9de70b8d9f4bfb5e210" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="0368f349fe8e816b17ff6acc7b23d1dc1005654a7b30d0e1d70c8df8b381a614" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="74ab063994a334c92a80c7a9dfbfcc56824a20e07324e72a6a8749b27186ab35" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="10d9e56cef39561bc571393719dcc20e00dff6816ac281ddaccbf6450813fc90" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="438c7f3afee143fced09d054c2e05319ea90dd682d6bb3b3881fd20180eb4784" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7b8236668af17a24a911b74a12789bacc4ddf32b8fb2abeb481759ef0a4505f9" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="02edeef35ba74870cf5b27ab23ade7c77cd665384cc833a2c86ee65ca00fdf80" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="4cd6c8fe39bf555285b636db615a5decddcb9b8a17b5f5c5047fe498b88a523e" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="581799be927b825ba2119629b89dcfe20f162e2f8415e6a5bc53f69d2fa573c4" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="42c83ba1bf562eedc13c641784480405cca2ee42f71c4520d4976bb8b02871f5" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8776fdf4c890bd192f40d1853db3dc2fb3a4520dff8c5d534b40948e4e76e92b" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="1dd16a6b3e2a1223f6b63936d8b93fa15b9ed04daeff18eb4061d58f292f945d" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="33499cf7788d41d903c025c63295ccc71ef4ed6119977ba01d956cecfe488bc2" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="5b09439c26d50c365715b2c9ba7ba2265b53d0cfcb904742739f9f0fb44ee448" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="abb03a4039f3b485c0e75d38e4593923790e247d1d6537454c0ceee378fbc7ef" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="9156e5b3b99139aeedcfb9fd0fc147db1eea9e052b57e1368a4ea58afdf5ba58" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="42c77af7b1c6418861af5b0075e3a35668e561b539d51075787a9b5984414a7e" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="4cd45035bf088f265cb73f962f50252c1f9bac1b5f9d90eecf4ea46b680f8de4" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="949f4a2646b881565321f04993767940638f0f07d08783c4c6f8f1f0ff41d47e" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="fcfa006d74e1a766c2a54a0bf60a73fc734d3d8490e33f8eed7d53ae3e338ba2" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="1e9a4010f75af44400639d224f575c6ac87c0c2445056ee1b0e0e7aee64cd526" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b5a2600a6223acaaec3834b0e991c391c5d43e4238b5d79655be2f0dfc4812e2" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="b036e38d8fef144bfc9d31f87f9e334e100dd3d57cded5c344140857d68dc697" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7f9d66e0388c5523d9c9a9ad6b94b73d5e2265da179c9fd3182b1f4d1ba3be77" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f2fae075c0d6670eca4273f298d64da145f872b3204c85884bb3c76312f21b44" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="fadd3fca1038747162f001095b1935d6c0eba834f39248e540f8e99f86d221d0" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="738d3c85a90cb15ec1b88913f03ee8877728899b53f48077e569f0cd867009b0" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="284b59baeb1c751221559f019f181dc8957072c3483ad96d70dc53e438db349b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="63ce914683da1dcc7205587e0743a629899faf1b1629527ff836792845548ad6" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="8b37581104a94c01f6948c9c9b155054b07b81589d21f1803378b555a167ae1f" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git18.20ce9289" rel="150600.8.10.1"/>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
</package>
<package pkgid="d239408a90ce53f082bbbe21280c375b5158b7e65689b57549490db5d7a1bfd7" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="833db83b48cc0afd6994e59f83b4689a0a3190a6a3776db45bae88361d083884" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f72998045902fe502325a1d75bdefc6fcc17875aeca31fc11f0422e681d1b51b" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b56f5c5b32d23ab31e875502304ae0f12f33ebfd179a399a33e14780da73329a" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="3bd695958e9eecd7b3e51dea3efc12e4de71deb3178a40eeaa9b205249d2730a" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="6870717bdcd7c9d974885ec809fe34b7d74f24dc90d80ede9888d89b451c934d" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="a49631fd5736c24e1b54995b427c99c5f2cf4413173b6df64c5633b169833dbd" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="e8ac1e42c54c6577aeb6a2a552961bc8dba53ff58992fadb4ace7fc8d8943fb9" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git55.6a75e944" rel="150600.8.13.2"/>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
</package>
<package pkgid="45dbaf728c5c4ef6c9a7fa264272a74a1f51dec2a4bc78c22341387a3890f5ac" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="a09770fe1c4f17cdc5abde1e5c965413ce1f7919356c46ea473df5b7c5fb34eb" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="17bab2b4b3196d62ac6f998633731fccbe2a63be7527c9e27b1899c5281dfcdf" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="d84b7a5f230ac585869c36b3c7c4721516fdbd2fa361e3e255584bcd0a0ad400" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git99.aa5d0ecbf" rel="150600.8.20.1"/>
  <changelog author="william.brown@suse.com" date="1666353600">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464001">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1729252800">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- bsc#1231462 - re-enable use of .dsrc basedn for dsidm commands
- Update to version 2.2.10~git18.20ce9289:
  * Issue 6349 - RFE - Use previously extracted key path (#6363)
  * Issue 6067 - Update dsidm to prioritize basedn from .dsrc over interactive input (#6362)
  * Issue 6331 - UI - Instance fails to load when DB backup directory doesn't exist (#6332)
  * Issue 6343 - Improve online import robustness when the server is under load
  * Issue 6345 - Ensure all slapi_log_err calls end format strings with newline character \n (#6346)
  * Issue 6336 - Fix failing CI tests (roles) due to slow import (#6337)
  * Issue 6304 - RFE when memberof is enabled, defer updates of members from the update of the group (#6305)
  * Issue 6324 - Provide more information in the error message during setup_ol_tls_conn() (#6325)
  * Issue 6307 - Wrong set of entries returned for some search filters (#6308)
  * Issue 2472 - Add a CI test (#6314)
  * Issue 6276 - Schema lib389 object is not keeping custom schema data upon editing (#6279)
  * Issue 3555 - UI - Fix audit issue with npm - micromatch (#6310)
  * Issue 6301 - Fix long delay when setting replication agreement with dsconf (#6303)
  * Issue 6280 - Changelog trims updates from a given RID even if a consumer has not received any of them (#6281)
  * Issue 6295 - test_password_modify_non_utf8 should set default password storage scheme
  * Issue 6192 - Test failure: test_match_large_valueset</changelog>
  <changelog author="william.brown@suse.com" date="1738843200">- bsc#1230852 - persist extracted key path for ldap_ssl_client_init over repeat invocations
- Update to version 2.2.10~git55.6a75e944:
  * Bump openssl from 0.10.66 to 0.10.70 in /src
  * Issue 6258 - Mitigate race condition in paged_results_test.py (#6433)
  * Issue 6566 - RI plugin failure to handle a modrdn for rename of member of multiple groups (#6567)
  * Issue 6375 - UI - Update cockpit.js code to the latest version (#6376)
  * Issue 5732 - Localizing Cockpit's 389ds Plugin using CockpitPoPlugin (#5764)
  * Issue 5793 - UI - movce from webpack to esbuild bundler
  * Issue 6004 - idletimeout may be ignored (#6005)
  * Issue 6468 - Fix building for older versions of Python
  * Issue 6446 - Fix test_acct_policy_consumer test to wait enough for lastLoginHistory update (#6530)
  * Issue 6509 - Race condition with Paged Result searches
  * Issue 6191 - Node.js 16 actions are deprecated
  * Issue 6016 - Pin upload/download artifacts action to v3
  * Issue 6497 - lib389 - Configure replication for multiple suffixes (#6498)
  * Issue 6470 - Some replication status data are reset upon a restart (#6471)
  * Issue 6386 - backup/restore broken after db log rotation (#6406)
  * Issue 6490 - Add a new macro function and print rounds on startup (#6496)
  * Issue 6494 - Various errors when using extended matching rule on vlv sort filter (#6495)
  * Issue 6417 - (3rd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6480)
  * Issue 6490 - Remove the rust error log message for pbkdf2 rounds
  * Issue 6485 - Fix double free in USN cleanup task
  * Issue 6269 - RFE - Add nsslapd-pwdPBKDF2Rounds configuration to PBKDF2-* plugins (#6447)
  * Issue 6468 - RFE - CLI - fix cherry-pick error
  * Issue 6468 - RFE - CLI - Add logging settings to dsconf
  * Issue 6472 - CLI - Improve error message format
  * Issue 6417 - (2nd) typo
  * Issue 6417 - (2nd) If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6460)
  * Issue 3555 - UI - Fix issues reported by npm audit
  * Issue 6446 - on replica consumer, account policy plugin fails to manage the last login history (#6448)
  * Issue 6432 - Crash during bind when acct policy plugin does not have "alwaysrecordlogin" set
  * Issue 6302 - Allow to run replication status without a prompt (#6410)
  * Issue 6417 - If an entry RDN is identical to the suffix, then Entryrdn gets broken during a reindex (#6418)
  * Issue 6340 - RFE - extract keys once (#6413)
  * Issue 6415 - BUG - Incorrect icu linking (#6416)
  * Issue 6258 - Resolve race condition for two tests in health_config.py
  * Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user
  * Issue 6349 - RFE - extract keys once (#6363) (#6394)
  * Issue 5920 - pamModuleIsThreadSafe is missing in the schema</changelog>
  <changelog author="william.brown@suse.com" date="1744891200">- bsc#1241016 - enable memory accounting as SUSE disables it by default
- Update to version 2.2.10~git92.5c7db176:
  * Issue 6734 - BUG - format strings may not contain backslash (#6749)
  * Issue 6505- CI - backport changes for check_value_in_log
  * Issue 6501 - CLI - dsidm role rename was not working
  * Issue 6744 - BUG - memory accounting is not always enabled (#6745)
  * Issue 6492/6493 - CLI - dsdim can not create nested/filtered roles
  * Issue #6740 Certificate verify fails in FIPS mode
  * Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
  * Issue 6603 - Release tarballs ship a different Cargo.lock
  * Issue 6743 - CLI - dsidm add option to list DN's
  * Issue 6735 - CLI - dsidm provide option to set decription when creating an entry
  * Bump tokio from 1.43.0 to 1.44.2 in /src (#6732)
  * Issue 6728 - CLI - Issue with user rename operation (#6729)
  * Bump openssl from 0.10.70 to 0.10.72 in /src (#6730)
  * Issue 6515 - CLI - dsidm get_dn does not return JSON format
  * Issue 6713 - ns-slapd crash during mdb offline import (#6714)
  * Issue 6562 - Fix issues around slapi_filter_sprintf (#6725)
  * Issue 6464 - UI - Fixed spelling in cockpit messages
  * Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
  * Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
  * Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
  * Issue 6494 - (4th) Various errors when using extended matching rule on vlv sort filter
  * Issue 6494 - (3rd) Various errors when using extended matching rule on vlv sort filter
  * Issue 1925 - Add a CI test (#5936)
  * Issue 6571 - Nested group does not receive memberOf attribute (#6679)
  * Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
  * Issue 6155 - ldap-agent fails to start because of permission error (#6179)
  * Issue 6656 - UI - Enhance Monitor Log Viewer with Patternfly LogViewer component (#6657)
  * Issue 6655 - fix replication release replica decoding error
  * Issue 6632 - Replication init fails with ASAN build
  * Issue 6436 - MOD on a large group slow if substring index is present (#6437)
  * Issue 6553 - Update concread to 0.5.4 and refactor statistics tracking (#6607)
  * Issue 4673 - Update Rust crates
  * Bump esbuild from 0.24.0 to 0.25.0 in /src/cockpit/389-console (#6602)
  * Issue 6561 - TLS 1.2 stickiness in FIPS mode
  * Issue 6494 - (2nd) Various errors when using extended matching rule on vlv sort filter
  * Issue 6343 - (2nd) Improve online import robustness when the server is under load
  * Issue 6554 - During import of entries without nsUniqueId, a supplier generates duplicate nsUniqueId (LMDB only) (#6582)</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 2.2.10~git94.9af9dfe56:
  * Issue 4989 - Confusing error message from dsconf plugin set --enabled (#6750)
  * Issue 6276 - UI - schema editing and memberof shared config not working correctly</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- bsc#1242666 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1747137600">- bsc#1241988 - get_dn fails with python error
- Update to version 2.2.10~git99.aa5d0ecbf:
  * Issue 6626 - Ignore replica busy condition in healthcheck (#6630)
  * Revert "Issue 5120 - ns-slapd doesn't start in referral mode (#6763)"
  * Issue 6438 - Add basic dsidm organizational unit tests
  * Issue 6439 - Fix dsidm service get_dn option
  * Issue 5120 - ns-slapd doesn't start in referral mode (#6763)</changelog>
</package>
<package pkgid="dac681f057dd17ebe044ffcd71b89b00d6aae6d0a05f118ec21b430d5717b6f8" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="619a7b637daba6d951bf78ef4010f62afa54b930860f2b647586268854e9a60b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="afef0c94fc40cacffd96a9d7bacdfe57bd3c36da4b150855dca82fb6d5dc2bfe" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8a70393192618581a8431af780dff751fa1decc8f9cf8694736b48c64dbe1035" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8af5d5640ffcfb0a5a25f6a196a4dfba6bfd96e0f0d5a9bd67a9d7862f100cb4" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="844cd5941c57aa9e02ae80a689b3da3fd819391c325982a875bf259f15b96014" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="56483be9c92d9a201761067b64a759063ca2cac2795845177210d857d473898f" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c87fba4d4ca1908cafabbe82ca97ff47203db4caa75caeb6f47d3b8048b5081c" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="486c59da5a948c8a04f849c9dcfe1a371dc34eb11286f28c8b7cf17976487e89" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="39b5dd9d30ba78b764d1911e7a39a4fb1451eb9aaf549c5599db3f71f14b6e39" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="68b5eae28c78ea78a5e98aa8c0b8003222323b164943207aaaead222f7d0a5f0" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8edd9cd30f7081586754acc75c0c3ccc68c0679cca479f0defb732d604643b38" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="5dc85a370073237745c76eb90a9b8b7602a0cb5241e97a2841dcf4da2401600a" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="6ce5ed4f24766be45476b31224d8f50953b63e77d5c62528bb0dbfe9b6286339" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="3ca0f12ec52e3b77d75ff9450e997254ecf12c07591b746b35a6c95a43979338" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c74e1f67e22cfbfaad06883c435ae809288a22ea481d88b3e3b48465424c861b" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1dab7a5c1d8bf8b358868199ea92bd9a3ef0bd3b9bd7135b8498e0754caafb0c" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1eec6c4934925982aac38d300b1928fad8b41ede706d4d60f770848230d9c559" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="08abb5a50de17537363a63884e86ebc656693737f6c5d9d4395f48a31ff24acf" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="9790eae5ae81838114105cd059c37ac1d2daafb5e3b9aa85d845295f779f16aa" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="572698d2554f54db6cbdde244d1ebe19c1598f78c7879c600720c4143fd84abf" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="77464805c99e75b65112719043afdd91b13af4f04abd83094e0ceca75bcca09f" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="a71e291ba9d88334d227200b82d0f3394ca97649990ca9d1bb12cfaa74505733" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7d347b83f06b1d2878f88b0b0421241b2bb39974ba612980340fc605494818bd" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="b87a854547a763e0627c5a9b7ca9a0f49b5ee6a18ace8485d6b26ae3d06c1f2a" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a0ca292998fba1953af0262fb1ce988222b3382bf0d3aeaa49bdf7a7a9bd907b" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="297aba2c01f47a35604c1f347fc105fb858a7f636da9cf422ea75b321ebd99a7" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="fa9c5cca62642398136ccbed7a213eb3d101aeaf33f516d010b654559dc46506" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8c5962ffe0dab67b15d76d10ceddc7e925745a5de52b66e7affcf2ae1bd0ae90" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8f32ebd7c5c5344ecb4b53a7eef7bf0ec8936548648a7257e10f541ac4f430a2" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="a3c54ce3fafe5c84d1ac25c132a5775b086d5e193f844036fbe3564ca3388db9" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="f10d140fbf270939bfec37db2a1ccdfa38e1ca26a84afd97a18e961c84c2b373" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="ea8fd0f11727d1717a58d8497dba728a033cb3de4d83e03ebd12fc72b0ba4c27" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="df10814e4d7d96ec7dbf2abdc2e1ed0ea3889f2759f48734562de556735f905d" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="68660614004b0c8516b6305ece3fb7d179d4e7a61458c4cd2773462fde9d7228" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="d8e20d886ba80b4e7faf12259a806d983cea65883ba9353cf916f0359ea4fc59" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="e68b5aa967a6c143ca221840999b84b12b29bed60a70aa4ae3c55cfe69426d29" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8b3bf80f40354fb9d9c18e77943c7055c7b8ca1aed1191fbd9ef5516ec234243" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="8716d445b995cf077b200aa9f0248da784d9e243628a26914922e56d327f9708" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="449fe7d54592df27b7d85d59efa3b28e09e8694a2716ae28c2424439b6f5308d" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="7b9d7484c1cb1e4a3923bc6c67bc406ff623ddc7ec4b9f718807221725f14474" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="92fa212d68eb16fd864208de6349afc178f22b8dd4de75810de3f485e4819fcc" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="9738e5f190424f915fecc8761c27ecd8a4fbbbd03ab0613698e6fe25c3a9c306" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="39c4aa22eb6ed9a5a49ed9126bffcc27892adc910aff59738fcfba92b7046204" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.5.1"/>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1742990400">- build with PIE mode also when using gcc13 (bsc#1239941).</changelog>
</package>
<package pkgid="64b96cd71b556830a7c4a3883260d2b3e8165a95fed6b7c74b77875e9d208778" name="FastCGI" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="88d2dac9dfc3e05a4c02d370e130eeea0e41edea1af0662d6528011a7d73c1cc" name="FastCGI" arch="ppc64le">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="e39c81acf43ab4f7ea2ff02c1c71266587d2acb1054203b5b4be2ea868d841f8" name="FastCGI" arch="s390x">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="58926c68542712c3e00e18512d356618213a518da1153ce36a89ff4cebbac0ec" name="FastCGI" arch="src">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="mrueckert@suse.de" date="1157716800">- add README.supervise
- small spec file cleanup</changelog>
  <changelog author="mrueckert@suse.de" date="1158321600">- add perl_make_install for all distros other than suse.</changelog>
  <changelog author="mrueckert@suse.de" date="1161345600">- remove perl_make_install for now ... i wont build for fedora
  any time soon.</changelog>
  <changelog author="coolo@suse.de" date="1234785600">- fix build with gcc 4.4</changelog>
  <changelog author="crrodriguez@suse.de" date="1246017600">- disable static libraries</changelog>
  <changelog author="mrueckert@suse.de" date="1253188800">- add fastcgi-2.4.0_missing_call_to_fclose.patch (bnc#525009)</changelog>
  <changelog author="jengelh@medozas.de" date="1261310400">- enable parallel build</changelog>
  <changelog author="coolo@novell.com" date="1291636800">- fix build for factory</changelog>
  <changelog author="idonmez@novell.com" date="1306411200">- Add FastCGI-perl514.patch: fix compilation with Perl 5.14</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Enable parallel build</changelog>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="ffc3ce273034256638049d1f3429e4083eea187de95e9b6c4e4ab3aca68cadae" name="FastCGI" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="0943d73f860940a4107647b2ff2f1783dfc79ef3c77f9a2ce03688519edb9ada" name="FastCGI-devel" arch="aarch64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="63e05d20b0f11bf7059c458bb984f02f11940755826b220a076b58209ee01b89" name="FastCGI-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="b84ddf4e342d856ab1c6c45737a99c84d74c9c4489a1afa72a3e3c35d47661be" name="FastCGI-devel" arch="s390x">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="a9fe25ecb0693464ef5908ab01f40069340996daefaefd077e43c233236afb09" name="FastCGI-devel" arch="x86_64">
  <version epoch="0" ver="2.4.0" rel="150000.4.3.1"/>
  <changelog author="coolo@suse.com" date="1318680000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="mrueckert@suse.de" date="1324468800">- added FastCGI-fix_deprecated_api.patch: (bnc#735882)
  Fixes an issue where CGI.pm received CGI variables from previous
  requests. CVE-2011-2766</changelog>
  <changelog author="cfarrell@suse.com" date="1332849600">- license update: SUSE-OML
  Use SUSE- proprietary prefix until license is accepted upstream by
  SPDX.org. Fedora tracks this as OML.</changelog>
  <changelog author="coolo@suse.com" date="1339416000">- require the right version of perl</changelog>
  <changelog author="boris@steki.net" date="1363780800">- re-enable SLE support as %perl_requires is too new</changelog>
  <changelog author="fcrozat@suse.com" date="1409572800">- Update license tag to spdx 1.2.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418472000">- Split out the system library, following the shared library
  conventions
- Make devel subpackage depends on shared library package</changelog>
  <changelog author="jengelh@inai.de" date="1419076800">- "libfcgi++-0" package name is wrong (should be "libfcgi++0");
  change to libfcgi0 (due to libfcgi.so.0 being present, which is
  the main one).
- Remove pointless --with-pic (it is enabled by default anyway)</changelog>
  <changelog author="coolo@suse.com" date="1506254400">- add FastCGI-perl526.patch as perl 5.26 no longer has . in @INC</changelog>
  <changelog author="mrueckert@suse.de" date="1752580800">- added fcgiapp-integer-overflow.patch  (boo#1243325 CVE-2025-23016)
  FastCGI: FCGI versions 0.44 through 0.82, for Perl, include a
  vulnerable version of the FastCGI fcgi2 (aka fcgi) library</changelog>
</package>
<package pkgid="e0212b2db6e13c07f7b81540dca77b60400f06c247cb32b2d3cf5486c179f5b5" name="GraphicsMagick" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="aee37979cf1b8ddd752f059d7414194e46c808020a4aa0e55b28ca34fa48ce6a" name="GraphicsMagick" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="88da728c8aec3cdea5ac936759b6b1c6668866e922493e5fe21f31a4b48bf29f" name="GraphicsMagick" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="7d0602d94f3cbce7b3d690c04ede6b7df912f7b5e807d8dba943a536489aa8a8" name="GraphicsMagick" arch="src">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="afac4a952ac3217dcc0cefeb64bf42c72146f359a58b5bd6c6efabc7af77f2bd" name="GraphicsMagick" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="9906595bea3280e16d9e2293e32c9db5e0c0933e40a4ec98111b21fff27fc92c" name="GraphicsMagick" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="2983f28e51feffb974a2796968012632cb2c6227db6e0a73ea6fa19ef7a2d09b" name="GraphicsMagick" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="1a2a76fc1f8002af4007151ffef383874ebd14f40b1d94de06cac9d9e6d0ea79" name="GraphicsMagick" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="cf94c231d474bf783c23b45dd7e2e50c4b1a44d630498b8d62e9d9ca7875d350" name="GraphicsMagick" arch="src">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="f0aaf71645f09957e2f190e75e6f07274f32fca8d674401877c3f06a3ed8c914" name="GraphicsMagick" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="261a530a94bc1e1bd255d2101a465f27bdf4151f37c12c4d054043e6609b87e4" name="GraphicsMagick-devel" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="77be54c7f6b05faf168d0a8876f089bec2bab90ae4e5bdda4e01e98ad0b0894a" name="GraphicsMagick-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="d0db3124b551b4d33672724344968381acea2a705e45f1e44b1f6f1f138f95cb" name="GraphicsMagick-devel" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="b30f858d01642025d6383a706a42ab2090c15f28804d318c18ef720caf774258" name="GraphicsMagick-devel" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.4.1"/>
  <changelog author="suse+build@de-korte.org" date="1577448000">- version update to 1.3.34
  * DPS: Eliminate a memory leak.
  * Debug Trace: Only output text to terminate an XML format log file
    if XML format is active.
  * EXIF Parser: Detect non-terminal parsing and report an error.
  * EXIF Parser: Eliminate heap buffer overflows.
  * HuffmanDecodeImage(): Fix heap overflow in 32-bit applications.
  * MAT: Implement subimage/subrange support.
  * MVG: Address non-terminal loops, excessive run-time, thrown
    assertions, divide-by-zero, heap overflow, and memory leaks.
  * OpenModule(): Now properly case-insensitive, as it used to be.
  * PCX: Verify that pixel region is not negative. Assure that opacity
    channel is initialized to opaqueOpacity. Update DirectClass
    representation while PseudoClass representation is updated.
    Improve read performance with uncompressed PCX.
  * PICT: Fix heap overflow in PICT writer.
  * PNG: Fix validation of raw profile length.
  * PNG: Skip coalescing layers if there is only one layer.
  * PNM: Fix denial of service opportunity by limiting the length of
    PNM comment text.
  * WPG: Avoid Avoid dereferencing a null pointer.
  * WPG: Implement subimage/subrange support.
  * WPG: Improve performance when reading an embedded image.
  * Wand library: In MagickClearException(), destroy any existing
    exception info before re-initializing the exception info or else
    there will be a memory leak.
  * XPM: Rquire that image properties appear in the first 512 bytes
    of the XPM file header.
  * Compliles clean using GCC 9.
  * Python scripts related to the build (enabled by --enable-maintainer-mode)
    are now compatible with Python 3.
  * Now supports using Google gperftools tcmalloc library for the memory
    allocator. This improves performance for certain repetitive work-loads
    and heavily-threaded algorithms.
  * Configure now reports the status of zstd (FaceBook Zstandard)
    compression in its configuration summary.
  * TclMagick: Address many issues mentioned by SourceForge issue #420
    "TclMagick issues and patch".
  * PNG: Post-processing to convert the image type in the PNG reader based
    on a specified magick prefix string is now disabled. This can (and
    should) be done after the image has been returned.
  * Trace Logging: The compiled-in logging default is always to stderr,
    which may be over-ridden using log.mgk as soon as it is loaded.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
</package>
<package pkgid="2ac25c14b7bcce2fe5acc0a47120cfb1cbd578afc12e784872575580b1e8b7f7" name="GraphicsMagick-devel" arch="aarch64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="f93fab9bc5bfe68118111106352cb29b16b5f4da1adaf5d5e7040d3c1e9d767d" name="GraphicsMagick-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="3aafba55bd5c0b048fb816cca3df6dc11ac98f9e0572567f37127dd4d0a30280" name="GraphicsMagick-devel" arch="s390x">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="20ffc11fe75dce4a2160bc8a62a47cbe2e54d315c16b1c3d5697e54ab8fa35bd" name="GraphicsMagick-devel" arch="x86_64">
  <version epoch="0" ver="1.3.42" rel="150600.3.7.1"/>
  <changelog author="suse+build@de-korte.org" date="1577620800">- Relinquish resources used by OpenMP on all devices (GCC &gt;= 9)
  + GraphicsMagick-wait-for-threads-close.patch
- Set configure options to what is actually build</changelog>
  <changelog author="suse+build@de-korte.org" date="1577966400">- Due to a broken check, it wasn't noticed the typemap file is
  already provided in the source archive (removed typemap)</changelog>
  <changelog author="suse+build@de-korte.org" date="1578139200">- Revert the change to relinquish resources used by OpenMP on all
  devices. There are concerns upstream that this might break
  applications that use OpenMP too and suddenly find their threads
  closed (remove GraphicsMagick-wait-for-threads-close.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1578312000">- Remove xorg-x11-fonts runtime Requires, gm display no longer
  fails when it is missing (see boo#619103).
- Cleanup, replace $RPM_OPT_FLAGS with %optflags</changelog>
  <changelog author="pgajdos@suse.com" date="1585137600">- version update to 1.3.35
  Special Issues:
  * It has been discovered that the 'ICU' library (a perhaps 30MB C++
    library) which is now often a libxml2 dependendency causes huge
    process initialization overhead.  This is noticed as unexpected
    slowness when GraphicsMagick utilities are used to process small to
    medium sized files.  The time to initialize the 'ICU' library is
    often longer than the time that GraphicsMagick would otherwise
    require to read the input file, process the image, and write the
    output file.  If the 'ICU' dependency can not be avoided, then make
    sure to use the modules build so there is only impact for file
    formats which require libxml2.  Please lobby the 'ICU' library
    developers to change their implementation to avoid long start-up
    times due to merely linking with the library.
  Security Fixes:
  * GraphicsMagick is now participating in Google's oss-fuzz project due
    to the contributions and assistance of Alex Gaynor. Since February 4
    2018, 398 issues have been opened by oss-fuzz (some of which were
    benign build issues) and 11 issues remain open.
    The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  There are too many
    fixes to list here.  Please consult the GraphicsMagick ChangeLog
    file, Mercurial repository commit log, and the oss-fuzz issues list
    for details.
  Bug fixes:
  * Fix broken definition of ResourceInfinity which resulted in that
    GetMagickResource() would return -1 rather than the maximum range
    value for the return type as documented. (problem added by the
    1.3.32 release).
  * ModifyCache(): Re-open the pixel cache if the cache rows/columns do
    not match the owning image rows/columns.
  * Fix DisplayImages() return status.  The return status was inverted.
  * HISTOGRAM: Histogram once again includes the histogram as a text
    comment.  This became broken by previous security fixes.
  * PICT: Fixed heap buffer overuns reported multiple sources.
  * JNG: Detect when JPEG encoder has failed and throw an exception.
  * MVG/DrawImage(): Performs even more parsing validations.
  * Clang static analyzer fixes: A great many fixes were made based on
    problem reports by the Clang static analyzer.
  * Visual Studio static analyzer fixes: A great many fixes were made
    based on problem reports by the Visual Studio 2019 static analyzer.
    Many of these may improve the robustness of 64-bit code.
  New Features:
  * GRADIENT/GradientImage(): Improved accuracy of gradient levels as
    well as dramaticaly improving performance.  Output PseudoClass
    images if we can.  Add support for using the image 'gravity'
    attribute as well as the "gradient:direction" definition to produce
    gradient vector directions corresponding to SouthGravity (the
    previously-existing default), NorthGravity, WestGravity,
    EastGravity, NorthWestGravity, NorthEastGravity, SouthWestGravity,
    and SouthEastGravity.
  API Updates:
  * InitializeMagickEx(): New function which may be used in place of
    InitializeMagick() to initialize GraphicsMagick.  This
    initialization function returns an error status value, may update a
    passed ExceptionInfo structure with error information, and provides
    an options parameter which supports simple bit-flags to tailor
    initialization.  The signal handler registrations are skipped if the
    MAGICK_OPT_NO_SIGNAL_HANDER flag is set in the options.
  Feature improvements:
  * Replace use of non-reentrant legacy POSIX functions with reentrant
    equivalents.
  * Timing of image reads should now be very accurate.  The timer was
    sometimes not stopped as soon as it should be.
  * PICT: The PICT reader is working pretty good now.  It handles all
    the PICT image files I have available to me.
  Behavior Changes:
  * POSIX Signals: Use the normal termination signal handler for SIGXCPU
    and SIGXFSZ so that ulimit or setrlimit(2) may be used to apply CPU
    (RLIMIT_CPU) and output file size (RLIMIT_FSIZE) limits with the
    normal cleanup, and without dumping core. Note that any output files
    currently being written may be truncated and files being written by
    external programs (e.g. Ghostscript) might be left behind unless
    they are to a temporary file assigned by GraphicsMagick.
  * Some private string and integer constants were removed from the
    apparent library ABI.  Some private functions were marked static and
    removed from the apparent library ABI.  This is mentioned because
    someone is sure to notice and be concerned about it.
  * The remaining private content in installed header files was moved
    into -private.h header files which are not installed.  This should
    not be cause for concern but is mentiond because someone is sure to
    notice and be concerned about it.</changelog>
  <changelog author="pgajdos@suse.com" date="1591099200">- security update
- added patches
  fix CVE-2020-12672 [bsc#1171271], heap-based buffer overflow in ReadMNGImage in coders/png.c.
  + GraphicsMagick-CVE-2020-12672.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598356800">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="pgajdos@suse.com" date="1609156800">- version update to 1.3.36
  Security Fixes:
  * fix issues found by oss-fuzz project
  * WPG: Fixes for heap buffer overflow.
  Bug fixes:
  * ConstituteImage(): Set image depth appropriately based on the
    storage size specified by StorageType and QuantumDepth.
  * GetImageBoundingBox(): Fix problem that MagickTrimImage with extreme
    fuzz values could produce an image with negative width.
  * ImageToFile(): Improve error handling to avoid possible deferred
    deletion of temporary files, causing unexpected excessive use of
    temporary file space.
  * JNG: Add validations for alpha compression method values and use
    this information to enforce decoding using the appropriate
    sub-format (rather than auto-detecting the format).  Also, address
    memory leaks which may occur if the sub-decoder does something other
    than was expected.
  * MagickCondSignal(): Improvements to conditional signal handler
    registration (which avoids over-riding signal handlers previously
    registered by an API user).
  * ModifyCache(): Fix memory leak.
  * ReadCacheIndexes(): Don't blunder into accessing a null pointer if
    the using code has ignored a previous error report bubled-up from
    SetNexus().
  * MNG: When doing image scaling and the image width or height is 1
    then always use simple pixel replication as per the MNG
    specification.
  * MVG: Fixes to 'push clip-path foo' and 'pop clip-path foo' parsing
    to eliminate a class of malign behavior.
  * MVG: Place an aribrary limit on stroke dash polygon unit maximum
    length in order to avoid possibly rendering "forever".
  * PCL: No longer attempt to handle reading HP PCL format via the
    external 'hp2xx' program since it seems worthless for that task.
  * PS: Fix corrupt image when writing PseudoClass image with a colormap
    larger than two entries as bilevel.
  * SVG: Memory leak fixes.
  * SVG reader: Now support 'ping' support so the identify command works
    as expected.
  * TIFF: WEBP compression only supports a depth of 8 so force that
    value.
  * Wand MagickSetSamplingFactors(): Correct formatting of sampling
    factors string.
    New Features:
  * Logging is now fully programmable.
  * DPX format: Support dpx:swap-samples-read define which behaves
    similar to dpx:swap-samples, but is only applied when reading, as
    well as dpx:swap-samples-write, which is only applied when
    writing. This provides for use when there is both reading and
    writing in the same operation (otherwise the final result was no
    effect!).
  API Updates:
  * magick/api.h: Add "magick/enum_strings.h" to API headers.
  * New log settings accessor C functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These
    functions allow a program to set the same parameters which may be
    set by loading a "log.mgk" function.  If a default logging callback
    was provided via SetLogDefaultLogMethod() such that MethodOutput is
    used, then the search for a "log.mgk" is avoided entirely.
  * New log settings accessor C++ functions: SetLogDefaultFileName(),
    SetLogDefaultFormat(), SetLogDefaultOutputType(),
    SetLogDefaultLogMethod(), SetLogDefaultLimit(),
    SetLogDefaultGenerations(), SetLogDefaultEventType().  These C++
    functions just pass through to the equivalent C functions and
    provide the same benefits.
  * A simple resource-limit respecting memory allocator has been
    developed for internal use wherever arbitrarily-large amounts of
    memory might be requested.  This will gradually be added wherever it
    appears to be needed.  The memory resource limits are at the overall
    process level.  The MVG/SVG rendering code is updated to use this
    new allocator.  Almost all of the coders (image format
    readers/writers) have now been updated to use this new allocator.
    This means that '-limit memory 300MB' would be more complete and
    meaningful now.  Temporary allocations by the image processing
    algorithms (other than for the images themselves) are still not
    accounted for in the resource limiting.
  * MVG Renderer / DrawImage(): Use resource-limit respecting memory
    allocators for remaining large memory allocations.
  * PNG writer: Don't skip optional Exif identifier code if it isn't present.
  * DPX reader/writer: decode/encode of 10-bit packed DPX is now twice
    as fast due to code simplification.
  * TIFF reader: Apply the same resource limits to TIFF tile sizes as
    apply to the image itself.
- deleted patches
  - GraphicsMagick-CVE-2020-12672.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1639396800">- version update to 1.3.37
  * bug fix release, see NEWS.txt
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- added sources
  + GraphicsMagick-1.3.37.tar.xz.sig</changelog>
  <changelog author="pgajdos@suse.com" date="1649764800">- version update to 1.3.38
  Special Issues:
  * The FTP site ftp.graphicsmagick.org is now shut down due to a lack
    of bandwith, extremely abusive users (including from Google and
    customers of Amazon Web Services), and a lack of support from the
    user community.  Another factor is that FTP support has been removed
    from popular web browsers.  This is very unfortunate since the site
    served multiple usages, including providing a lot of historical data
    (e.g. related to PNG) which may not be available elsewhere.
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project due to
    the contributions and assistance of Alex Gaynor. Since February 4
    2018, ??? issues have been opened by oss-fuzz and ?? issues remain
    open.  The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Bug fixes:
  * Documentation: Generator scripts in 'doc' directory now produce
    similar results using GNU sed and Solaris/Illumos sed and don't
    produce warnings.
  * JNG: Fixes to error handling to avoid temporary file leaks and
    avoiding returning a broken image.
  * JPEG: Always store embedded profiles in image, even if in 'ping'
    mode.
  * MAT: Change from using 'int' for sizes/offsets to using 'size_t' and
    check all related calculations for overload.
  * MIFF: Fix heap buffer overflow which may be provoked in builds with
    BZLIB support.
  * MogrifyImage() and Magick::Image::trim(): Trim requires
    NorthWestGravity.
  * PICT: Fixed a heap overflow.
  * PerlMagick: Fix issue that image fill attribute had its opacity
    reset to transparent so it could not be usefully set at image scope.
  * Test Suite: Fixed portability issue related to 'sed' which broke
    utilities/tests/convert.tap test script.
  * WPG: Fix incorrect TrX and TrY elements in CTM.
  New Features:
  * Added support for a 'Read' resource limit (e.g. '-limit read 5mb').
    This allows the user to specify a hard limit for how much data may
    be read from a file, read from a pipe, or decompressed from a file
    (e.g gzip or bzip2) before a hard error is reported.  This resource
    limit is a useful alternative to completely disabling support for
    compressed files using the --disable-compressed-files option and it
    provides more protections as well.
  * Added support for reading HEIF/HEIC format.
  * Added support for reading and writing JPEG XL format.
  * Support for JasPer 3.0.0 is completed.  Upgrading to JasPer 3.0.0 is
    strongly recommended due to its many security fixes and integration
    with GraphicsMagick's resource-limited memory allocator.
  * PNG: Support the define png:chunk-malloc-max=limit in order to allow
    reading PNG files which report "chunk data is too large" or to
    reduce the default limit.
  * compare: Added support for the '-compress' option.
  * compare: Added support for the '-auto-orient' option.  This tries to
    assure that the two images are right-side up before comparing.
  API Updates:
  * Magick++: Support the new 'ReadResource' enumeration.
  Feature improvements:
  * JPEG: Implement more efficient way to append JPEG profile chunks.
  * Resource Limited Memory: The resource limited memory allocator now
    maintains useful statistics such as a tally of the total number of
    octets moved by realloc.
  Windows Delegate Updates/Additions:
  * None
  Build Changes:
  * In maintainer mode, the configure script searches for a GnuPG 'gpg'
    program to use for signing snapshot releases and uses this to
    support PGP-signed development snapshots.
  Behavior Changes:
  * None
  * fixes CVE-2022-1270 [bsc#1198351]
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)</changelog>
  <changelog author="munix9@googlemail.com" date="1673179200">- version update to 1.3.39
  Special Issues:
  * GraphicsMagick really does need some additional productive
    volunteers.  For several years now, the burden has entirely been on
    me (Bob Friesenhahn).  I have been sheparding the project for 20
    years already (and contributed to ImageMagick and GraphicsMagick
    combined for 26 years already).  It is not reasonable to expect
    someone with a full time job (and expecting to retire in a few
    years) to do all of the work.
  Security Fixes:
  * GraphicsMagick is participating in Google's oss-fuzz project since
    February 4 2018 due to the contributions and assistance of Alex
    Gaynor and Paul Kehrer. The issues list is available at
    https://bugs.chromium.org/p/oss-fuzz/issues/list under search term
    "graphicsmagick".  Issues are available for anyone to view and
    duplicate if they have been in "Verified" status for 30 days, or if
    they have been in "New" status for 90 days.  Please consult the
    GraphicsMagick ChangeLog file, Mercurial repository commit log, and
    the oss-fuzz issues list for details.
  Security Fixes:
  * oss-fuzz: Several security fixes originating from oss-fuzz testing.
  * ALL: Replace strcpy() with strlcpy(), replace strcat() with
    strlcat(), replace sprintf() with snprintf().  Prefer using bounded
    string functions.  This change is made for the purpose of increasing
    safety than to address any existing demonstrated concern.
  Bug fixes:
  * Coverity: Several fixes for issues found by Coverity to reduce the
    number of reported issues back down to zero.
  * Clang Analyzer 12: Fix most discovered issues.
  * PNG: Fix possible use of uninitialized 'ping_num_trans' value in
    ReadOnePNGImage().
  * MinGW: Eliminate overwrite of existing _MSC_VER value in MinGW compile.
  * MNG: Fix heap-use-after-free in CloseBlob.
  * MNG: Fix indirect leak in MagickMallocCleared().
  * PS: Assure that 'bounds' structure is initialized.
  * EPT: Assure that 'bounds' structure is initialized.
  * HEIF: If heif_image_handle_get_metadata_size() returns 0, then
    carrying on with reading image data.
  * configure.ac: Fix Bashism in maintainer-mode check.
  * TGA: Remove a defective validation of comment length, which blocked
    reading some sample TGA files from the "Encyclopedia Of Graphics
    File Formats" book.  Monochromatic bilevel TGA can now be read and
    written.  TGA "Footers" are now read and used when logging as well
    as converted to Image attributes.
  * WebP: Add configure.ac updates to check for libsharpyuv so that
    builds with the development version work again.
  * Visual Studio Build (VisualMagick): Fix project file generation.
    Improve portability of code for configure.exe.
  * Fixed mixed encoding (non-UTF-8) errors in text and source files.
  * DrawPrimitive(): Fix composition using "0,0" for image size.  This
    became broken in GraphicsMagick 1.3.36.
  * Blob API: Fixed SEEK_END validation.  SEEK_END was not used before,
    but now it is.
  New Features:
  * AVIF: Support reading AVIF via libheif if it supports decoding AVIF
    (still no writer support).
  * LOG: Added function IsEventLogged() to report if a particular event
    will be logged.  Us this as much as possible throughout the software
    to replace use of IsEventLogging().  This avoids a possible
    performance hit if any logging is enabled at all and logging
    statements are executed which are filtered and produce no output.
  * FITS: Support storing multiple scenes in one file (non-standard
    extension).
  * JPEG: Optionally enable arithmetic coder in JPG images using
    '-define jpeg:arithmetic-coding=true'.
  * JPEG: Add support for reading deep gray images.
  * HEIF: Support reading ICC color profiles.
  * Produce ASCII armored ".asc" format GPG signature files.
  * Support reading directly from .bz2, .gz, .svgz, and .Z files
    (without creating a temporary file), if possible.
  API Updates:
  * Magick++: Provide a version of Image::colorMapSize() which is a
    'const' method.  Continue to provide the non-const version in order
    to avoid an ABI change.  The compiler should choose the appropriate
    version.
  Feature improvements:
  * HTML documentation generation based on Docutils is significantly
    updated and improved.
  * PerlMagick: Added more sample input files and changed many reader
    tests to use hash signature rather than comparison to reduce the
    distribution size.
  * Blob: The ReadBlobString() function has been re-written to perform
    better when reading from files.
  * JXL: The JXL coder is updated to compile with what will likely
    become JXL 0.8.0.  Support for 16-bit 'short' samples, 16-bit
    'float' samples, and 32-bit float samples added.  Support for
    reading and writing ICC, EXIF, and XMP profiles added.
  * MIME: GM "magick" to MIME mappings have been added for apng, avif,
    bmp, ico, and webp (regardless of if they are supported).
  * XPM: The XPM reader performance is dramatically improved and is
    observed to be 32x faster when reading a medium-sized XPM file
    (e.g. the GraphicsMagick logo).
  * XPM: Support reading "deep" images with more pallete entries than
    the maximum colormap size.
  Windows Delegate Updates/Additions:
  * Update bundled libjasper to version 1.900.26. Please note that 4.0.0
    is the latest version at this time and fixes a great many security
    and stability issues which are present in 1.900.26.
  * Update bundled libjpeg to version 9e.
  * Update bundled libtiff to version 4.5.0.
  Build Changes:
  * MSVC: Added porting function to emulate C'99 snprintf for MSVC older
    than 2015.
  * MSVC: Successfully compiles using Visual Studio 2008 and 2019.
    Compiles successfully using Visual Studio 2022 if optimization is
    disabled (otherwise there is an internal compiler error in effect.c).
- Enable JPEG-XL on Tumbleweed.</changelog>
  <changelog author="pgajdos@suse.com" date="1675771200">- version update to 1.3.40
  * GetMagickGeometry(): Fix a scaling issue where dimensions could be
    scaled down to zero.
  * PCD: Handle writing image with a dimension of 1.
  * PNG: When writing, use lower-case raw profile identifiers (e.g. 'Raw
    profile type xmp') because exiftool expects that.
  * SUN: The sense of monochrome images was inverted.  Fix scanline size
    calculation.
  * WPG: Fix 20-year old bug in WPG header reading.
  New Features:
  * JXL: Decode and log extra channel information.  This information is
    not yet used.
  * PCX and DCX: Support writing uncompressed format (use -compress none
    for no compression).
  * Added IM1, IM8, and IM24 magick aliases for the Sun Raster format
    since those are the historically correct extensions.
  API Updates:
  * AppendImageToList() now updates the image list pointer to be the
    image which was just added.  Use GetFirstImageInList() when the
    pointer to the first image in the list is needed.</changelog>
  <changelog author="pgajdos@suse.com" date="1677758400">- clean up old conditionals</changelog>
  <changelog author="dmueller@suse.com" date="1691496000">- add strlcpy-wrong-sizing.patch: fix incorrect usages of
  strlcpy and strlcat detected by glibc 2.38's fortify</changelog>
  <changelog author="pgajdos@suse.com" date="1692878400">- version update to 1.3.41
  Bug fixes:
  * Blob: Immediately reject attempts to write blobs to formats which
    can not support blobs.
  * TranslateTextEx(): An empty string argument should return an empty
    string rather than a NULL string.
  * SetImageAttribute(): Fix bounds issue when concatenating string.
  * JPEG: Do not set image resolution if the values provided are outside
    of the valid range.
  * Fixes for NaN when reading formats based on floating point.
  * HEIF: Fix reading images with rotation/transformation.
  * BMP: Do not decode primaries or gamma unless colorspace is
    LCS_CALIBRATED_RGB.  Add/correct bmp_info.size "biSize" logic which
    decides if header chunks are present (or invalid).
  * MNG: Fixes for resizing using X_method 5.
  * GM command (convert, montage, mogrify): Many command-line parser
    fixes/checks for invalid command line syntax which causes unexpected
    behavior, or core dumps.
  * TopoL: Given that a writer is now provided, issues found in the
    reader (and writer) due to continual fuzz-testing have been fixed,
    as encountered.
  * GetImageClippingPathAttribute(): Check for and use clipping path
    name (ID=2999) to get the real attribute name.
  * ReadIPTCProfile(): Fix malformed IPTC data parsing.
  New Features:
  * TopoL: Now provides a writer.
  * WPG: Now provides a writer.
  * gm batch: Implement simple Test Anything Protocol (TAP) test
    counting and "ok N"/"not ok N" messaging.
  * TIFF: Support '-define tiff:photometric=minisblack' and '-define
    tiff:photometric=miniswhite' to be able to adjust the sense used
    when writing bilevel TIFF images.
  * TIFF: Require that TIFFTAG_EXTRASAMPLES be used appropriately to
    indicate the intention of extra channels.
  * utilities/tests/gen-tiff-images/genimages: Script for writing (and
    then reading) thousands (5568 permutations) of TIFF format variants.
  * EXIF and PNG: Retrieve image orientation from EXIF (if present) and
    store in image.
  * HEIF: Retrieve image orientation from EXIF and store in image.
  Behavior Changes:
  * The ability to extend existing image attribute text by calling
    SetImageAttribute() multiple times with the same key is now
    deprecated, and will soon be removed.  In the mean time, the
    annoying message "SetImageAttribute: Extending attribute value text
    is deprecated!"  is printed to the standard error output to help
    expose code which is using this feature.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693224000">- fix regression in 1.3.41
  https://sourceforge.net/p/graphicsmagick/bugs/722/
- added patches
  fix 17179:91afa18a6161
  + GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch
  fix 17180:bb42cd90ce6f
  + GraphicsMagick-name-key-return-input-file-base-name.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- revert to 1.3.40 [bsc#1214831]
  https://sourceforge.net/p/graphicsmagick/news/2023/08/because-1341-is-discarded-i-has-been-published-2-builds-for-win32-architecture/
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - GraphicsMagick-fix-regression-NULL-instead-of-empty-string.patch (not needed)
  - GraphicsMagick-name-key-return-input-file-base-name.patch (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1696248000">- version update to 1.3.42
  Bug fixes:
  * TIFF: Default the alpha channel to type EXTRASAMPLE_UNASSALPHA(2).
  * BMP: Many fixes for reading esoteric BMP sub-formats.
  * TranslateTextEx(): Revert change so now a NULL pointer is returned
    when given an empty string.  Some algorithms (e.g. montage) were
    depending on this!.
  * PAM: Fix reading comments.
  * PNG: Added Add missing module aliases "PNG00", "PNG48", "PNG64", so
    it is again possible to request these subformats directly.
  * TIFF: For common formats with the required number of channels, but
    one is an 'unspecified' channel, promote unspecified alpha to
    unassociated alpha so that the alpha channel is not ignored.
  * "Magick" command line emulation: Eliminate duplicate utility name
    output in error messages
  New Features:
  * BMP: Added the ability to read and write BMP using JPEG compression.
  Use '-define bmp:allow-jpeg' to allow use of JPEG compression.
  * BMP: Added support for BI_ALPHABITFIELDS compression
  * BMP: Added support for reading BMP with PNG compression.
- modified patches
  % GraphicsMagick-disable-insecure-coders.patch (refreshed)
- deleted patches
  - strlcpy-wrong-sizing.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1743508800">- security update
- added patches
  fix CVE-2025-27795 [bsc#1239044], JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits.
  + GraphicsMagick-CVE-2025-27795.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1744718400">- security update
- added patches
  fix CVE-2025-32460 [bsc#1241150], heap-based buffer over-read in ReadJXLImage
  + GraphicsMagick-CVE-2025-32460.patch</changelog>
</package>
<package pkgid="4ec1b7e5699edada116dd86a29ef259af87a3549a54f45b3ef1e9c3c3e9e7496" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="3124d1c12cf143854d6db0898adc34963e4c35a6cfbb5ce856a2b8712c79f16c" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="f360b39c7fb21d341ae2eaff5b04f11d30e0ad971505cbfae26eab532e8213d5" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.12.1"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
  <changelog author="varkoly@suse.com" date="1742817600">- HANA-Firewall built without PIE
  (bsc#1239943)</changelog>
</package>
<package pkgid="dc9a15c71a90d0666d09766034e3b2fb0ac7ef144ac088f7c2b2b37169eecdd9" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="8b53ff293f23bcf3fbb1bed0f5435c971b581b964ee571c4ffbeb7fab48d7f4b" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="58763b5397666c5ab986d7c13f57f971e2129d71c08c52ac07580b9e1cc57088" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="55ddea27637f12608dee80e47f64cf43190a469f5c160dfe5d90ef00e5295eb1" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="b7e07fa88715fecf6e84f9f57b8997410dc64f62564191b66d32a4bb71df8707" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="25b9c3aa5db4761d68da53e99fe45d1d53458516009608975c08ff4c65d349be" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="ecd161e1903867b48cc1165a31e011c641a749dca73bebe1cca7f364d79fbde1" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="c797fdd943294b93757108a206102d89890fd2d0e5fa3a063af98f814735a684" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="8653a3a9c76f414750fadc74e331488916f9931e0b3cab31ac9a430ac64528f2" name="ImageMagick" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="21878acdb06aa41f81f5c4d7942f2df96b944259b16d1c2a5f9c66deae630b77" name="ImageMagick" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="d155e3e5a59a52c45c92309916d1f2f668221c7761da22a8b688314228ad2e4c" name="ImageMagick" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="bb3d3a99c3680de7b3826a0bb2726412228a9485d380ea5d3104efcb3dc7f3fa" name="ImageMagick" arch="src">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="c9eb8376e6ebd29f734aa83d9f7375d54122fb7a7677e461e6db536f01feea7b" name="ImageMagick" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="896821e18540e1cc8ca3539d6615743ae7a6bc64d897016676ad73d16265274c" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="a1f0f37aa178db2ddb279644e281d04a58d935f3a78b4de62fb4aec0e121aeef" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="1b2365021e00cd2a738de42e383ba4fd1980c937f8c733d7fabe080694fa75f8" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="6a0c714cbc263a910e0c431ae68977f64c8c8137890de57e0bd0990f4bf62441" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="7cc3a611bd55e6d12c660d7ab863c49234c1da8a97c51ae432538036813cdb85" name="ImageMagick-config-7-SUSE" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="682084814a25d499cec9b7b10adebd50f4f08a3c5dd553d8eacbe963d6238cfc" name="ImageMagick-config-7-SUSE" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="1e0515fffa2153d52178d48a736b16bb079f5a56c9cb3ab2d38239359357e389" name="ImageMagick-config-7-SUSE" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="d73fc174c84b29ddfc050b3cb85c17a47ecd102106928d79eb2d639c37eb8395" name="ImageMagick-config-7-SUSE" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="04393ac30361bac9a39104938fcc47655a6617eb18c2c7d6877288bf587e331f" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="882c05e02c4ce21397e9806af8a5a7d0a553187f79d8a7ef1b821356b9a57223" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="becd84dd2ac2e58d7e42fdb109220fcb983da29fa4743b8dee9bb374444d20f1" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="a9890d22648b8c58da5f0bb9b6e92da64e4b8a6489a1844c063e0848a062aba1" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="6369a046e0add8ea0ebc0eb5fda553bd025416be721b08b7ca512d5534effb97" name="ImageMagick-config-7-upstream-limited" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="7863833d198a3b90a4ecc3f579a945a59f6f19ecdaae65dbd9b609838d7932d1" name="ImageMagick-config-7-upstream-limited" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="4e33559949c20072229b4bae87548ca4cea9cbef60a2a010fa60c6e5fe63813c" name="ImageMagick-config-7-upstream-limited" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="0174007bae9373c2bb0b0b0f688cce9c4d41fa38c1d2be3c7cb9b170208c6da4" name="ImageMagick-config-7-upstream-limited" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="5380d94b5740eb9a1dee296d4d1ec037291ca5808aeacb1946f2eec311ce13da" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="601a4d327b4efca7da7aeaa175995e9f3ba5e442093a0ac79039e2b0838aeef5" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="2ffeffd8686b422fee9cf6e5bc24c472175f5bd80e60cd76b8d87262e66d5574" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="be9b9e85e311492b8855fb97a212928d20d7b7eabc573a094f2c6d55c1a3ff25" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="3be08a30a20dc3b936fc14f198f7f9357ce9bb3cd40e790a031af412f3d49d99" name="ImageMagick-config-7-upstream-open" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="7085ed5126ba7bc9671e9f993849b372726e62a2b0c50bd7a1c5522cf7241042" name="ImageMagick-config-7-upstream-open" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="843dcf5d9a05564768544e3b2c84680cb6e679e913fb93bf324e4269f83a1690" name="ImageMagick-config-7-upstream-open" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="2124e12c3c84d5a0716667a7dfeef84c3e1201b07f0c114ac4b9377df471c14f" name="ImageMagick-config-7-upstream-open" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="df7501989823399050764db44e64b1841fb5192ec5ead27af071a80362232541" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="042b6d7405c35dc20a1d7f6c9d9ac81d8e619f86574e06cdd9b17c041e80c142" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="051941550283a7ec3c7fdc013aff9024cfdead39c2206a9cf7d414da50662abf" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="331ad5b8a9cb9cd908e497035068ea50243bb9f48c89af20bf5309ce8d32747f" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="e881ea834d421d6bcf6435528971b13c145e3e85c75cd2b240cbeca93e16a29e" name="ImageMagick-config-7-upstream-secure" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="798c14e1ada7cb0e574339a0160aa0db038a408d0fab298a1689aaa468a3362c" name="ImageMagick-config-7-upstream-secure" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="56d3d399a3410f927bbf8eba766961420faf6e5489e61ade390178708985db19" name="ImageMagick-config-7-upstream-secure" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="2d62eeb48dc898800691cf57c2f3d5a30fb73f6cebb8ab6d4e9ed64c53b3106f" name="ImageMagick-config-7-upstream-secure" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="55e0fcb52cd4d19f27262e82c1b17d359ee19650531bdc7339366773609028a4" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="e378a34b25e19f525ca59e0df9a51b054e4dae4c8762470d0f034c093fba0cec" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="50e3711f14dd2759ba083ae558f41f135f7383e97bdedaad1340fd0421e8f20b" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="f8705d482cf83c4aa5eec806441353d6390f35cec199fc03a5c0b82bbf0e62d5" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="8951ec59847eaa1af821634bed0d0ff4b59f2b9068dd0db329cd1985fd6e7556" name="ImageMagick-config-7-upstream-websafe" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="567ba43fbfc047dbeac27af79a892f6e4a4cbaebfad382423da61e3586560e86" name="ImageMagick-config-7-upstream-websafe" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="a9d4815c77a68ed080f0234c663e2792069be3ec3e668fce64eaea418b8849f5" name="ImageMagick-config-7-upstream-websafe" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="dbd9f586c284e0316a74ecdc8936e64f40dd183f60769b53b0536b1599ed6231" name="ImageMagick-config-7-upstream-websafe" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="e687f108b9b086ffabe7aa03e35217105cf76ef3e0d908846c59862cd9337147" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="861dad0a73b4b335f9843153b45372326a3522d5f71109fc11f240787f063b48" name="ImageMagick-devel-32bit" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="646af0a65ba1f97ed82ce1eda40bfbc332266b392db84995b734030cce214520" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="f774a7afa1bb79fffdd8b8f54672bac38160ad8f9b29de74534a271c883a87a7" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="5b1501e5987acc077a00578f8db9b1ef4de81a6639f8bee3f0b913d995d80b3e" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="86a6227ac4aaee338005682f9ac47bed1dd9f1f4d74c148e175170c7a9dc9d71" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="afb416d5068b02656d34e9a847bd80ef3b5c2bdfe3c7cf29ac1a0ead09a0e155" name="ImageMagick-devel" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="c62400f0ef18750b8e696ac6431348dd18db5ce9e219e691701c2670eb1d1c1b" name="ImageMagick-devel" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="6b2a18b0c7e7d8c0bef96f77175e947044b783e0e1e1a4930cb2a2c931faf05b" name="ImageMagick-devel" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="00e29c21d2b97ec3762b9539a375186b999cd2a694921423dc85e3d70b23e508" name="ImageMagick-devel" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="403d383165fadd54eda09fe50459f2d233f30804dc6dcb07b187fbf938586895" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="0e791f9ffb3427bb6e981e50e73768b2a3823e401a34b2df173374580d6e8a16" name="ImageMagick-doc" arch="noarch">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="6cfe3cbc310fce3628d5bc66358210bd94dd1aa2e3a7a50ed6e5f7e6f1f4feec" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="68ab3676b076328e5bf39236f0a6135b83938f276f1f1257cfb75f7c012ed988" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="35f0dcfa6ef4ddeca1f63473501af11e457b9e43b93b6389dc8031f48b6280b5" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="2c6b111aa7d8331ab36fbfcef18e329c234a30e1a3f34fdff26acef21ce78a0d" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1677758400">- cleanup old conditional, really build without djvulibre if requested
  (now %bcond_without djvu)</changelog>
  <changelog author="mpluskal@suse.com" date="1678363200">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="mpluskal@suse.com" date="1678708800">- Revert last change - it leads to file conflict involving .la files</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
</package>
<package pkgid="c45c6c2888d116eebee26c732d4ad20b7ce828f5b9379200f3355a910b8405e8" name="ImageMagick-extra" arch="aarch64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="58ae7b2033dd3ad5b11ba532a4d265a191349c547c9a625e5e2a711b182241aa" name="ImageMagick-extra" arch="ppc64le">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="f21926664b47daf998c701865bcd2ca3e46b25f04247add173b2e825944266ce" name="ImageMagick-extra" arch="s390x">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="88d2536dc2ac1f108ccf7345c4cba46c445fea9b554f3a2e69074c44a871f868" name="ImageMagick-extra" arch="x86_64">
  <version epoch="0" ver="7.1.1.21" rel="150600.3.8.1"/>
  <changelog author="pgajdos@suse.com" date="1678795200">- version update to 7.1.1.3
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- [bsc#1209141] CVE-2023-1289</changelog>
  <changelog author="dmueller@suse.com" date="1680177600">- update to 7.1.1.5:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-5---2023-03-26</changelog>
  <changelog author="pgajdos@suse.com" date="1681387200">- version update to 7.1.1.6
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-6---2023-04-02
- fixes CVE-2023-1906 [bsc#1210308]</changelog>
  <changelog author="deepthi.venkatachala@suse.com" date="1683115200">- version update to 7.1.1.8
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-8---2023-04-22</changelog>
  <changelog author="dmueller@suse.com" date="1684411200">- update to 7.1.1.9:
  * support for Oklab
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-9---2023-05-14</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- version update to 7.1.1.10
  * fixes CVE-2023-2157 [bsc#1211601]
  * fixes CVE-2023-34475 [bsc#1212234]
  * fixes CVE-2023-34474 [bsc#1212237]
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-10---2023-05-21</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 7.1.1.11
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-11---2023-05-29
  * [bsc#1200389] CVE-2022-32546
  * [bsc#1211792] CVE-2023-34153
  * [bsc#1211791] CVE-2023-34151</changelog>
  <changelog author="pgajdos@suse.com" date="1688040000">- version update to 7.1.1.12
- added patches
  fix CVE-2023-3428 [bsc#1212847], heap-buffer-overflow in coders/tiff.c
  + ImageMagick-CVE-2023-3428.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 7.1.1.15
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-15---2023-07-30
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- deleted patches
  - ImageMagick-CVE-2023-3428.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1695297600">- version update to 7.1.1.17
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#711-17---2023-09-19
- modified patches
  % ImageMagick-library-installable-in-parallel.patch (refreshed)
- follow upstream, create open, limited, secure and websafe alternative
  configuration packages with different policy.xml
- removing p7zip redundant dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 7.1.1.18
  * upstream changelog:
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1695988801">- allow verbose perl tests
- add ImageMagick-s390x-disable-tests.patch, adjust two and disable
  one failing test on s390x</changelog>
  <changelog author="pgajdos@suse.com" date="1696507200">- version update to 7.1.1.19
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
  * fixes CVE-2023-5341 [bsc#1215939]</changelog>
  <changelog author="pgajdos@suse.com" date="1697112000">- version update to 7.1.1.20
  * https://github.com/ImageMagick/Website/blob/main/ChangeLog.md</changelog>
  <changelog author="pgajdos@suse.com" date="1697198400">- added patches
  fix https://github.com/ImageMagick/ImageMagick/commit/3c727503c6ae449160dc92cf6222ebe28ef8fb52
  + ImageMagick-correct-time-to-live.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1699876800">- version update to 7.1.1.21
  https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- modified patches
  [bsc#1217014][bsc#1216811]
  % ImageMagick-s390x-disable-tests.patch (refreshed)
- deleted patches
  - ImageMagick-correct-time-to-live.patch (upstreamed)
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/8f3c56fabc619c1672865257e5aafe33cbfaaf3e
  https://github.com/ImageMagick/ImageMagick/commit/3a7b915d9a810ce742987b37c935f6ae8b36df10
  + ImageMagick-infinite-resource-time-limit.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1745496000">- security update
- added patches
  CVE-2025-43965 [bsc#1241659], mishandling of image depth after SetQuantumFormat is used
  + ImageMagick-CVE-2025-43965.patch
  CVE-2025-46393 [bsc#1241658], mishandling of packet_size and rendering of channels in arbitrary order in multispectral MIFF image processing
  + ImageMagick-CVE-2025-46393.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1747396800">- fix config policies [bsc#1243622]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1748433600">- fix [bsc#1235113]:
  https://github.com/ImageMagick/Usage/issues/8
  https://github.com/ImageMagick/Usage/issues/9
- added patches
  https://github.com/ImageMagick/ImageMagick/commit/056ccdbeac41c9b24b625e0139cd25a4cdffb22a
  + ImageMagick-0-1-are-special-cases-for-pow.patch
  https://github.com/ImageMagick/ImageMagick/commit/be3b73da674520ad3eab52ade2a3cda62af66d15
  + ImageMagick-check-for-pow-zero.patch
  https://github.com/ImageMagick/ImageMagick/commit/1afa38ae2fa87cf4eb48040e47d410aa729ce21e
  + ImageMagick-gamma-should-call-GammaImage.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1748865600">- relax list-length, delegate and stdin/out policies [bsc#1235113]
- modified patches
  % ImageMagick-configuration-SUSE.patch (refreshed)</changelog>
</package>
<package pkgid="538ccb523dc43f1e00a50b18f6fa9288a644e037410775107ccb820c2b782899" name="Mesa" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ff8ce9044b5a375a23a252186165fcb5fe198e71b9c7c755acadfa20c55b65a" name="Mesa" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f975b24613315011daff881124f7731801fbfa2b4f95b43fabe819e8115aa21c" name="Mesa" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a705e70e3c533c4ebbb87fa76c7c34c5d3b54bef1dfcd69517cad8de1ba05016" name="Mesa" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59534e8eec4e576130ecdd1677fc8d275ac00fc4d0c8a55546aba2bafff3f2cd" name="Mesa" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d22fbb0f09abcc011c4275b2443dc8e7b4f8e0ad33b176c34fcbe87f43a31eab" name="Mesa-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="18eedf6fbaf0283aff1ffd25f1b8fe408ea768ad5afad1450662d1e336590da7" name="Mesa-KHR-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2a24e2b784af480f15e4f326fafa0878040c65d3985a6e7eb7916f35ba2f8726" name="Mesa-KHR-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2c28dcc2e2112857d9094e53a938ccb30cd8394b0947205e75fabcfcb8ffb2c3" name="Mesa-KHR-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a15b75d61f3d0cc156a4300d172288c3f1d762e84934e8841255a0bc8e2f01fe" name="Mesa-KHR-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="54b6564cbf45c22caea3a0fa53dde6560d928fdc17c1409bac655be8e42efaf5" name="Mesa-demo" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="ddbd4a58cb01597f9ae1a969a33eb1417f73b778df5f5a146a0709ebb30c7342" name="Mesa-demo" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="fb5d415d85edc40a30c40e8d9d63e80b68c71c03c7ad25f402c975f8ac16cd85" name="Mesa-demo" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="b773c85d8bce0f0c2a73ec04435e49092fc26cf0575005035dafa984825c61d6" name="Mesa-demo" arch="src">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="sndirsch@suse.com" date="1326283200">- added automake to BuildRequires to build fix on factory</changelog>
  <changelog author="cfarrell@suse.com" date="1326369600">- license update: MIT
  SPDX format</changelog>
  <changelog author="sndirsch@suse.com" date="1327406400">- renamed package to MesaDemos</changelog>
  <changelog author="sndirsch@suse.com" date="1328702400">- renamed package to Mesa-demo
- spefile cleanup</changelog>
  <changelog author="jengelh@medozas.de" date="1329134400">- Update package BuildRequires to use pkgconfig symbols</changelog>
  <changelog author="sndirsch@suse.com" date="1331812800">- added "-x" subpackage for most common GLX-based demos like
  glxgears, glxinfo, pbinfo (bnc #748373)</changelog>
  <changelog author="sndirsch@suse.com" date="1336651200">- fixed build by making use of autoreconf</changelog>
  <changelog author="sndirsch@suse.com" date="1348488000">- fixed build by replacing these strange osdemo{,16,32} scripts
  by the proper binaries</changelog>
  <changelog author="sndirsch@suse.com" date="1348574400">- reverted previous change; seems this is no longer necessary</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1361707200">- Update to version 8.1.0
  * changes for OpenGL Core Profile
  * Wayland support within eglut
  * various updates to the OpenGL tests/demos
  * glxgears now supports multi-sample visuals
  * new EGL/OpenVG tests
  * large number of other changes</changelog>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="6b08c1c5c43f44b3cb2ecabeeb430a6e7dd4fb7794d2a718e35b0a5b5a03d209" name="Mesa-demo" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="f1ebdc2b17bbc68124c93db59d16de6f0b2fdf0c93e508a3c9fa5d3a1c8fbebc" name="Mesa-demo" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="2a8818ec61a5edd399b454367cf290c90d6f598cddf64b1fab29a93d9e8c6d18" name="Mesa-demo" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="5e8c194d3769315bf7cceb0fa66102fd381d8da881f63106834513f868fa960e" name="Mesa-demo" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="25c7e36a7d3a49f1aca0b1f7bf2ad7078197d7983e578fd2476202c3c793f3ab" name="Mesa-demo" arch="src">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="cfarrell@suse.com" date="1326369600">- license update: MIT
  SPDX format</changelog>
  <changelog author="sndirsch@suse.com" date="1327406400">- renamed package to MesaDemos</changelog>
  <changelog author="sndirsch@suse.com" date="1328702400">- renamed package to Mesa-demo
- spefile cleanup</changelog>
  <changelog author="jengelh@medozas.de" date="1329134400">- Update package BuildRequires to use pkgconfig symbols</changelog>
  <changelog author="sndirsch@suse.com" date="1331812800">- added "-x" subpackage for most common GLX-based demos like
  glxgears, glxinfo, pbinfo (bnc #748373)</changelog>
  <changelog author="sndirsch@suse.com" date="1336651200">- fixed build by making use of autoreconf</changelog>
  <changelog author="sndirsch@suse.com" date="1348488000">- fixed build by replacing these strange osdemo{,16,32} scripts
  by the proper binaries</changelog>
  <changelog author="sndirsch@suse.com" date="1348574400">- reverted previous change; seems this is no longer necessary</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1361707200">- Update to version 8.1.0
  * changes for OpenGL Core Profile
  * Wayland support within eglut
  * various updates to the OpenGL tests/demos
  * glxgears now supports multi-sample visuals
  * new EGL/OpenVG tests
  * large number of other changes</changelog>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="618d621eb99d38d8a49eae1ee5bf7915c5f216cc440da4b375a3b65032b0879c" name="Mesa-demo" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="6127462136d413a968826276c2ff155a2c70bfb9fe6aa3d2476aace9d2e0f22d" name="Mesa-demo-x" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="c918d221f70629e538250a359031839a738cf928e8f964928035ed1d4b44b8a6" name="Mesa-demo-x" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="0b32c1c1320bbfd8be38bdc73f26a2672e23241d796860f561164b3f67557935" name="Mesa-demo-x" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="4d137072675f1312515da4d32ba5b09d6dfa9ef2b47f792e0309d13a183e5875" name="Mesa-demo-x" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.3.2"/>
  <changelog author="opensuse@cboltz.de" date="1367409600">- let Mesa-demo-x own /usr/lib*/mesa-demos/ and /usr/lib*/mesa-demos/xdemos/</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
</package>
<package pkgid="34a3a02e355a1556d738e5272f1310c87cd400dece9b047204842567fcc236b8" name="Mesa-demo-x" arch="aarch64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="56e6ebdfca2531a62475c7db60ebe54ebe57b02a4f8283a54c76e216be77f431" name="Mesa-demo-x" arch="ppc64le">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="d3f2deb5e14030ee69d84fd4b71886a705d16050a0d4dd33bf426be0cdf3cb70" name="Mesa-demo-x" arch="s390x">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="e5caf330b48c65eb06d0776cfb3272b512ccdf4c54a3bcc8337a4f8a02a51b53" name="Mesa-demo-x" arch="x86_64">
  <version epoch="0" ver="8.3.0" rel="150000.3.6.1"/>
  <changelog author="hrvoje.senjan@gmail.com" date="1371297600">- Enable build of gles{1,2} and egl info, and symlink them to
  %_bindir
- Split egl dir into separate subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1399550400">- U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * drawtex: resolve glDrawTexfOES extension function; fixes build
    with latest Mesa 10.2-rc1 (fdo#78101)
- u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch
  * fixes fatal compiler warnings</changelog>
  <changelog author="sndirsch@suse.com" date="1404907200">- Update to version 8.2.0
  * This new mesa-demos release fixes the build issue against mesa
    10.2 (fdo#78101) and picks up the latest glxinfo changes.
- obsoletes patches:
  * U_drawtex-resolve-glDrawTexfOES-extension-function.patch
  * u_drawtex-fixed-compiler-warnings-related-to-use-of-eg.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="sndirsch@suse.com" date="1435147200">- disabled egl build due to Mesa's removal of skeleton
  implementation of EGL_MESA_screen_surface with release 10.6.0
- removed egl subpackage</changelog>
  <changelog author="sndirsch@suse.com" date="1449748800">- Update to version 8.3.0
  * This new mesa-demos release fixes the build issue against
    mesa 10.6 (Bug #91643) and picks up the latest glxinfo
    changes.
- supersedes u_mesa-demos_missing-libs.diff
- no longer disable egl build</changelog>
  <changelog author="jengelh@inai.de" date="1485777600">- Update RPM group; use faster find+ variant.</changelog>
  <changelog author="sndirsch@suse.com" date="1496059200">- includes everything needed for missing sle issue entries:
  fate #315643-315645, 319159-319161, 319618 (bsc#1041312)</changelog>
  <changelog author="sndirsch@suse.com" date="1740830400">- added "-egl" subpackage for common EGL-based demos including
  eglinfo, eglgears, egltri, peglgears, xeglgears, xeglthreads
  (boo#1235680)</changelog>
  <changelog author="sndirsch@suse.com" date="1743595200">- don't depend on non-existing Mesa-demo-egl package
  (boo#1227477, comment#32)</changelog>
</package>
<package pkgid="80065c08f49029a4e0b8993deedba375f419a5841049b661dc246ce6937b41a9" name="Mesa-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e4df26cb2d1a961e29142c69cff86d6173db9c6fd40dfb70ec00990969f2601e" name="Mesa-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="05d630c1b19786df3dfe80bb16385f83e800d0584a6e34e43a2f382f515fb154" name="Mesa-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="5beb4fa7791cd75ff48e932d607b4a3d83e31a715ffc2506c9eb24d27458cb87" name="Mesa-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3450623cb40065a95edf7a65168fee2a9e9d0e73a2d762ea1a1f0fbe44ac3df3" name="Mesa-dri" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b85c3a5c8494198c7074dd095190519823b4faf963a0093fa2304b192290888a" name="Mesa-dri" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="edc89c978bda4f7158680b245003621a9b71353e062cda63420031abf11c9957" name="Mesa-dri" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3e09091ccb69b9be1c8f7af5cf162d809f8b23ddaf5ed9b79ccbd5b780b84493" name="Mesa-dri" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="932e0835005cb2c8fecda3c1036e0134e5d354896f4ff750bd677ba7b83e067e" name="Mesa-dri-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64d4475f6d056ff2827fa4f191d9d7fe62859fb4ed5b1a9050d341ab159f1114" name="Mesa-dri-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fca088335b7c01ce8455930e2b94784f5c0147faae8c42317e4678699f7fd796" name="Mesa-dri-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a7fc42fd38eb990b86841f735d964c03d03f2f3226f2bb036d870d976105fafd" name="Mesa-dri-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="daa3fd3f57de23c48cda460c51696aedb2527a22b68d6717feecce75f672b311" name="Mesa-dri-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e9145d09855903d979f6030baa3873ad42dbcfe57a1f55b288d8b15319c22ade" name="Mesa-dri-nouveau" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="64351c63a47b2a09d0cf4ee91edaf72da6d0521ddbbd9b3e7631a319ee247573" name="Mesa-dri-nouveau" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9866a0ac7173e32ae06e42d3344b5d440a4241b0441f3c90ce15638018310346" name="Mesa-dri-nouveau" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d60c22fd7ebbf41bf19a7a3007b2aa5d7779b4677f0916ef36abc332b4b22ce2" name="Mesa-dri-nouveau-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="637dd4a730f9f447f70df22f3290e0ffab7f48e9cb83a85504f9d58a6ddc092b" name="Mesa-dri-vc4" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4cbb5f7aa8697f5624993d26192dc724a1d148ad34fca3128ee8d5ed07adae4d" name="Mesa-drivers" arch="src">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c33245cbe7c4878a294857de3f71d66780f19eadc9eb71813afc469101a90545" name="Mesa-gallium" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d4dc999f06c78163d82722cf91702451d72619714065cff5d1357b3fcff1a9a8" name="Mesa-gallium" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="209d876d9db8a0c8114943f4e9b46cee8193f0726d04701733b9c682345e4b6d" name="Mesa-gallium" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fcfa46cf55b2d9abdfdcf57fb35f885def9fff7b02768c6d01bc5d505c1d6b14" name="Mesa-gallium-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="921d565bda22dbfb5c2fd4741c140833a3dc43f7c9ded54c02dca6a5bc86e9da" name="Mesa-libEGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ab0b12d1347c74f3d41eda45b0920b0d5eb7c4d1e5f57c9751bfc9adc93df2df" name="Mesa-libEGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="350c559e5801d8663d03bd55cac46f8404470531970b54ab2f38c4440de588b7" name="Mesa-libEGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4953bf6cff208cb8f7212e09c27638bd3ff1fb6f7f682120a51d5d3878d43ef1" name="Mesa-libEGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="910d6e4e2abbc15fb5636522ddf363ac0a39ad7586276a4f6673fa8e591c294e" name="Mesa-libEGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4edd97e2e145ed6250c5e49370f1e463ada074e19847be3b4fc9b455f22b83c9" name="Mesa-libEGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d1b204f505c749937363d910512a28d8a31675d42214dee2027e0b991853e95e" name="Mesa-libEGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f967a9c59ab6a89a72187b0862c15beb02f81cfa120970ea54afc94cc3703c94" name="Mesa-libEGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0862cfb043700377ce1e8b7b73a5ce807daecc634d25f25c5c88e03bcd4196d7" name="Mesa-libEGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="874585c0474aeb6faadb57cd4d77d3f582e6f5ffae7105311ad25bcb9d5f6a6d" name="Mesa-libEGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bc3c6373e6a407df04f2ca98430cc36be2bff77ba0eb870ded0c94712f15c311" name="Mesa-libGL-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="08ff55330b3f84fc9dc6ffbab185dac38acaf48025bffc327d9999aa2bdba902" name="Mesa-libGL-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="69ca303d8431dcc227fcb8dde0dcc0cd515a435289b2525eb7da1213936c9d6a" name="Mesa-libGL-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a57a3ad5d1093f0af760f382d51d0fc0eec976d40ca9c572633c312343261484" name="Mesa-libGL-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ca0652030034dbc6e0b37447df1b0e9589237551951518abbcd8eeb187815a3" name="Mesa-libGL-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="73d0a357d8d410ebb3b929d1b1a23fc63f880612705506076fe1cc3a372b7efe" name="Mesa-libGL1" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="bd8011f44e743013c881494346e0aae7f43ae044e2c7008af2c37ce8b5e54974" name="Mesa-libGL1" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="50fae9c380bdb59badba7effab955db12589ce1011e35dbf9932e9e643992ff8" name="Mesa-libGL1" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="d58cd2073611a17f8011e0854901353dd1f0d397d44f44b2ea296e3d3ff2fdb5" name="Mesa-libGL1" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="e41d4a8f8fa1fea9cdc7b1c79d120a20f63aab2412746b2759f1a06765e1244f" name="Mesa-libGL1-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="107895580ce9ee4e293eed7b8d3150550f432eb1ba017628f731e3142c5b64e1" name="Mesa-libGLESv1_CM-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f7420fdd9d2fcb2ac17beac8ead7ee4c04ba1d5e101803db28eb41e67bef094f" name="Mesa-libGLESv1_CM-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f968f61f8c027a95f21c823609fe20bc56cb1a57ab265ade34a01204e5f85f99" name="Mesa-libGLESv1_CM-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="80d9f2abe4d30e97ad306894f113160e09bb713d487cc68033e39a6059475b08" name="Mesa-libGLESv1_CM-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a0a1b5cc82b1e66a92e1a87b09e207b96ce4f76ab874dea653de4736b722f61f" name="Mesa-libGLESv1_CM-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4736d53d75239109d7b06a9ca874f2d50b57f3ba37b32bdcdabd9f0895afdca0" name="Mesa-libGLESv2-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="33b47411c40751a89f50f6247d348b276455dc01236a33c5118098ec52c09895" name="Mesa-libGLESv2-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="90d00e2bce3d804a9ec8a875e40553a7b4be35b94ca429d25dea604f39b2ca6f" name="Mesa-libGLESv2-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="9e55767c1f68ba0ee5d7f87fe5b0cbb971432e54c77ed896bdbeed31c099c8ad" name="Mesa-libGLESv2-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="59b7fc5411c4eecd247a05e155bf66dbf9ab5884ef26c045df650beae7280ded" name="Mesa-libGLESv2-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ecb8d1de3d80bb1b2727948e722bcedd9b014c4038731d7e749955f74f629463" name="Mesa-libGLESv3-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b8d1901dc680a18c04107825a1312ad8dc34c1bbf1efebd4b15321321af9df5a" name="Mesa-libGLESv3-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b1833c3fb290c8fc44b91af055904ef96bf7078ac371de06f15c5a09c35d86fc" name="Mesa-libGLESv3-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="3937ae7d4f3418f05e49c3d5089391830e06e8fd09d14e3788aa8ef671d1b19a" name="Mesa-libGLESv3-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a6eed22ec86822022557cb37d1fe80a22fe1feeaf705d16f67065f80e6a6a3b2" name="Mesa-libOpenCL" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0e2fa094dcfa7f77eb2979c55f43f7b2be19de79c078a2d7349eb673eb3f495d" name="Mesa-libOpenCL" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="0d990d92ed0399b4e8d2057ee94afe67d31a254c53e5a10feba41d0f21baa49d" name="Mesa-libOpenCL" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="789b3bfd73e1fd6f2fcb989d915628bd317567b99076fbbf16bc72e439032e2f" name="Mesa-libd3d" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a474302381e089e6c81b574134bc3c827a72dd9f3a97a2c5c1fb4cb9bf73d9ba" name="Mesa-libd3d-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="770b9bfc1ac3a684e8ac716e82077dd470f1404de55afc295e97081802bea2e8" name="Mesa-libd3d-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="c2fe226416f736323d4296a6323d65f1dae989c7defb6a4e1a2d2d0182f528da" name="Mesa-libd3d-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bba8a1a319a7fa2088dde55ff8b6991dcf83ffc32e58bda799bd69f4427f334" name="Mesa-libglapi-devel" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="812c5cb275bf9eec7c0a824c00b45be6ca322a75d4e2effb4709b32411d0b9cd" name="Mesa-libglapi-devel" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="cee1147049f8e8dd4122bcde873e673101d17e62c7f586068f6a4ec46bd775c5" name="Mesa-libglapi-devel" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="fde8f547c81251dab9290a95d0efe3a87501c7474bf4bd0516ad93fd3e42128e" name="Mesa-libglapi-devel" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="042a63728e7518603f9436a4e069894347a742117f02684c3618c77b34160bce" name="Mesa-libglapi-devel-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="457a2fbb0f603d08dd63a76419b597617cb719acab52c6ee6c9b4fe61e707b23" name="Mesa-libglapi0" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="2f39f1082f76be8fbaa1dc90879e3525360dbe2cb2c825c8ef70ecf8060686d1" name="Mesa-libglapi0" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4ec5ec4d9d82e43cd79a8cd8fb2e83734354623a4bba31b627f010d022f5822b" name="Mesa-libglapi0" arch="s390x">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="f3abdd24e1472df470dddc6791960cb6467b09e3f7bdfd623eaa37a425a1e5a3" name="Mesa-libglapi0" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ffc3232b737dda46df0f434a1b01bb6838d6a40a517997ea77d48ee2e2fa8ca0" name="Mesa-libglapi0-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="b5791b2f562817a56544b95cfd7b6a651c3e1f85eec5b68ccdf61ce38fbbb4cb" name="Mesa-libva" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="139ffcf4c74ac6fe9e356fa40c651f2f806db1fd0fb9fe496a7d91bb458bb726" name="Mesa-libva" arch="ppc64le">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="095203942b691f1697169703a0dc72d5d8d3326bc873bcc714f275f488a3fab3" name="Mesa-libva" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="4bd435faaa0acce4c71bb844f6abca64cd5a5091e80d17536340bf299c69c790" name="Mesa-vulkan-device-select" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="da317ed1bc412c7b4333be008bddbf22975e37cca3eb812d01502f68768d1289" name="Mesa-vulkan-device-select" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="6bf2c90cad60b264d9ae05459e5c35eebef5650305133e081051034028d1091b" name="Mesa-vulkan-device-select-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="a71496886b894a9b1e8d9dee09e794cdf4d2588898a86b5658dabd28e1e3ea01" name="Mesa-vulkan-overlay" arch="aarch64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="76d07c740d2189ddcb89124e156c7ebd5c19386c264610f143e6e745192d7ab4" name="Mesa-vulkan-overlay" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="ac0da2ac9473336d6d9bd3eb99157d9458dbc05c28100b288fb2cc721c096750" name="Mesa-vulkan-overlay-32bit" arch="x86_64">
  <version epoch="0" ver="23.3.4" rel="150600.83.3.1"/>
  <changelog author="sndirsch@suse.com" date="1695297600">- Update to bugfix release 23.1.8:
  - -&gt; https://docs.mesa3d.org/relnotes/23.1.8.html</changelog>
  <changelog author="sndirsch@suse.com" date="1695297601">- disable nine on arm/aarch64 in the hope to fix build on this
  platform; there is no need for Direct3D/Wine for arm/aarch64
  anyway ...</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695297602">- Backport upstream patches for compatibility with LLVM 17:
  * U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
    removes unneeded includes of header files that no longer exist.
  * U_clover-llvm-move-to-modern-pass-manager.patch migrates Clover
    to the new pass manager, since the old PM has been removed.</changelog>
  <changelog author="sndirsch@suse.com" date="1695643200">- Update to Mesa 23.2.0-rc4
  - -&gt; https://lists.freedesktop.org/archives/mesa-announce/2023-September/000731.html
- supersedes U_llvmpipe-only-include-old-Transform-includes-when-ne.patch
- disabled u_fix-build-on-ppc64le.patch (no longer needed?)
- adjusted n_drirc-disable-rgb10-for-chromium-on-amd.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to Mesa 23.2.1
  * Mesa 23.2.1 is a new development release. People who are
    concerned with stability and reliability should stick with a
    previous release or wait for Mesa 23.2.2.
  * Mesa 23.2.1 is an unusual first stable release due to the
    accidentl tagging of 23.2.0 durring the rc cycle.
  * Mesa 23.2.1 implements the OpenGL 4.6 API, but the version
    reported by glGetString(GL_VERSION) or
    glGetIntegerv(GL_MAJOR_VERSION) /
    glGetIntegerv(GL_MINOR_VERSION) depends on the particular
    driver being used. Some drivers don't support all the features
    required in OpenGL 4.6. OpenGL 4.6 is **only** available if
    requested at context creation. Compatibility contexts may
    report a lower version depending on each driver.
  * Mesa 23.2.1 implements the Vulkan 1.3 API, but the version
    reported by the apiVersion property of the
    VkPhysicalDeviceProperties struct depends on the particular
    driver being used.
  * More details in:
  - -&gt; https://gitlab.freedesktop.org/mesa/mesa/-/blob/23.2/docs/relnotes/23.2.1.rst</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1697284800">- Add U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
  Fix https://gitlab.freedesktop.org/mesa/mesa/-/issues/9889</changelog>
  <changelog author="dmueller@suse.com" date="1700049600">- build with valgrind only on 64bit platforms</changelog>
  <changelog author="sndirsch@suse.com" date="1700222400">- let sle15-sp6 require llvm17/clang17</changelog>
  <changelog author="sndirsch@suse.com" date="1700481600">- enable rusticl on sle15-sp6</changelog>
  <changelog author="sndirsch@suse.com" date="1700481601">- re-disable rusticl on sle15-sp6 to prevent more deps (rust-bindgen)
- buildrequire 'pkgconfig(LLVMSPIRVLib)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="sndirsch@suse.com" date="1700481602">- buildrequire 'pkgconfig(SPIRV-Tools)' also with disabled rusticl
  (new dep since some time)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701432000">- Update to version 23.3.0:
  * It includes NVK, a new reverse-engineered Vulkan driver for
    Nvidia hardware. This driver is still in experimental phase,
    not quite ready for prime time yet, but adventurous users can
    give it a go!
  * New extensions &amp; features (in no particular order):
  - VK_EXT_pipeline_robustness on ANV
  - VK_KHR_maintenance5 on RADV
  - OpenGL ES 3.1 on Asahi
  - GL_ARB_compute_shader on Asahi
  - GL_ARB_shader_atomic_counters on Asahi
  - GL_ARB_shader_image_load_store on Asahi
  - GL_ARB_shader_image_size on Asahi
  - GL_ARB_shader_storage_buffer_object on Asahi
  - GL_ARB_sample_shading on Asahi
  - GL_OES_sample_variables on Asahi
  - GL_OES_shader_multisample_interpolation on Asahi
  - GL_OES_gpu_shader5 on Asahi
  - EGL_ANDROID_blob_cache works when disk caching is disabled
  - VK_KHR_cooperative_matrix on RADV/GFX11+
- Drop patches fixed upstream:
  * U_clover-llvm-move-to-modern-pass-manager.patch
  * U_radeonsi-prefix-function-with-si_-to-prevent-name-co.patch
- Refresh patches with quilt.
- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="sndirsch@suse.com" date="1704542400">- Update to bugfix release 23.3.2
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.2.html</changelog>
  <changelog author="sndirsch@suse.com" date="1704974400">-  Update to bugfix release 23.3.3
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.3.html</changelog>
  <changelog author="sndirsch@suse.com" date="1705752000">- let Mesa-dri require libvulkan1 to get zink/swrast driver
  fallbacks working (hopefully); probably related:
  https://gitlab.freedesktop.org/mesa/mesa/-/commit/2a71f06f2938678d89d5ed1372cda6a7b55d964d</changelog>
  <changelog author="sndirsch@suse.com" date="1705752001">- u_0001-intel-genxml-Drop-from-__future__-import-annotations.patch
  u_0002-intel-genxml-Add-a-untyped-OrderedDict-fallback-for-.patch
  python36-buildfix.patch
  * fixes build against python 3.6</changelog>
  <changelog author="sndirsch@suse.com" date="1705752002">- python36-buildfix.patch
  * src/freedreno/registers/gen_header.py: hopefully fixes aarch64
    build</changelog>
  <changelog author="sndirsch@suse.com" date="1705924800">- split python36-buildfix.patch into two patches python36-buildfix1.patch
  and python36-buildfix2.patch; apply the latter only on sle15-sp6/Leap 15.6
  since on newer python releases than 3.6 it changes behaviour to
  remove required=True option</changelog>
  <changelog author="sndirsch@suse.com" date="1706184000">- Update to bugfix release 23.3.4
  - -&gt; https://docs.mesa3d.org/relnotes/23.3.4.html</changelog>
  <changelog author="sndirsch@suse.com" date="1727784000">- u_mesa-CVE-2023-45913.patch
  * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
- u_mesa-CVE-2023-45919.patch
  * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
- u_mesa-CVE-2023-45922.patch
  * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)</changelog>
</package>
<package pkgid="1a426f997cc0168ecb250364fa6604b47bcd0564f029c7a96afae394fe72025d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="10c3b0c8f2f597d6580a54a4adda9bf9ac011410a30476be5929ab8d4453cdc4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="139d13b84200eaf590a3950ad9c9edb2f585822b6b582f183465546e1820c4c6" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="f76af917fc4c70f5236b36bf156fb77aa60f71407d84ceb877cd21fc0029dc13" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0647d6b6c26df1d92782e8063ff2efc261af7cb22923d6c7a0a57b709df0ef22" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0a867cc6fe29af059fd9a019b0a45371226898ca55f7db97d1da4f8d968b4e89" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="775cb5b1262e75054931916e6c500ed37ec763927d3d7637671926564d507974" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f85ff2fa61a348b098d2004d3253d2df409eef5a0e8d6d9a9cbc49d965ecfee2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="353ad28e5e90b2dc2ad00684508d64ca2c4dcdffce3c8c9e67b47162aaa9086b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="aeb0d4d06e328123cfd8d5c218b0791b702393a6abf48b00012cef6b28ef4813" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7a49daa1e8fc9d658bec6d6007882493f2f84c07ebb9e32e93e49bc17b8c151d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="7904db243329c0a7ea97887bee3327a4b510187178090eedd78fa95b60ed8a77" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="59201665bcd24dbfa2976f389a070d12990a08e28b25b5f0d326dfe77afd712c" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a481807ad7984249b399fe269ce6c8e8f74323e0e207cf4339d2c0cacd237888" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8e01671d967da6c5aa852661ea3b262cc93106425d57477f6d0628cac2805051" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6aed81613cc268499cfaa2d8eafcf38ce7ede2a30e05ab77be66ef6e6147e8cf" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="edb08833d6b7b3172078b06355e41fcba406482d0ce450669607c98f8a1f08a8" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="ff9576e06fcd06c95ac3eb9c5e9cd8768fc34b6cd57680822026f0d4608170f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="8720ee6b012231234a75572ba4d8bc30587fd05b0a070f0b76a78362bcff21db" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="82aa1f2c54e9894493af5c519b9531431f9627c6c20e62dee64b5e3064a792c7" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="7899cf42dde29671b0f1bbcf97e93a50aac6554b8bb837131d7119f3e0f4e661" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="c84884c56be17639650c6c42d6bdc7f9a9de366d77afa60c3790ec1e5735295e" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="f6a28ebbafaf2027c44126b364b25d2aa541642cfa1bdd2844677c3fa0cef668" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="5a5b498a25771bedc7d1b37c4427af807e2c4b2866fc78ce65331d4925ed11d6" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="aaad4457c6c40a9b3998fc89555507e208282a67e852e25c7bd567a958406e46" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="4c2f5cf1a835766c1373082c7d805b983b7e9dadfb8f10a813b050424d180ad1" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="485a8dca1e0329db306620a469d600439eb466c26aa958f331b819fb0f1fba74" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="0ebe1f5f00855a2028b953fdeffbf479002f4b612a8cbe71a6d11b1e79af0206" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="6059c6cc05ab6d6ef99519ca1d8b59a5af237ff62e7395852907986abef61d59" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="dc81ed26d6c750ce9bbd10809320e776d8bcffb7802f0bba2cd2f06dc2cd790d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="270b8fc6172e7deeff33e9622df85e0263b83bda866e1da1c159af3298dc11d7" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="3fdda60aa69e6a2af274deda5435c543a1a2256cc461d54266fe813c21797e08" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="2458764e32621ed6a29e7bb585dedf0e7a16cf37a482cc1ac2e0644ed20574c7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="f0908ad9baa6203e1426814262bda9f6f819593aecf88ac414860230cd760dc8" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="f855f9c1fbba4f877097eb58cb9b06c8853b550d2843b45bfdfc0f38750dd659" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="ea32895a01de8ceb5ea8c4194e59b6be53ec3e9d159c0105d773691415419b8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="41f7073a928432a2257e50c06165675f9d78de318cc7b0867e10f676fc8c416a" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="6b45e7ad4ab3936be2660cbe91b8a1664d69977a83b42699c3916dd4eb1e02b0" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="40af497f50d5dc13b95329799e44cd8e55aa6adf2f06c285ba4231d5e4090578" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="89781066e52c9ec590b0875f7171663351cbd6e6ff97a195a9dd7711a98de7a5" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="b85e361467cadcf523f8951d6f7a2e6e7f306a6c7c939dd46f8c3fb3042fdfe6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="83f3a7723396ac9a3a1d3408ae8747308db739af93fb87a480b720f043200db4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="8f9386806342bf0dae48780ad612b72c336ca6eb2f53f9492da6b55400e88d78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e8bf775558315696bef3a10d4f3b7ec7a0ab1850dad741ad6d898cc70d1ed2e9" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="da59f9ee39a57e3c5285e6e2d9359adc9e1b023672e15810ac1e41372cd8cdf0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="3cb4419cb681dea6227d89229d0d9f27b962b521c0ce8eab21f40682fb62a37a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c06b0bd51eacb622d196ef369f134bb8932ef50e8081e2babb73b9e7f3bb7c66" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="260a6f210b5c4ee33f04d14f76f43ab0491a2b04f3ae327edd281cbf3899b116" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="b4fdba3e5ac14cbbaa84065c49998c6fb4fca2112c3d1c822d8b1add032e907b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="76b5d8578d2785318c31cba6204c28323590e31e41be84513eaaec31b188697c" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="1987219eaa9398db524e2524cc97d528c172c6b44d3cf2a2667aa0238a8ab0ee" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="68470f9f9f851ed1b996496f5095190f96577bbe0d1e1d620250458cf2570612" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="9468e08a1ab795fe76ff9afbbdcf35d061a6369a87df74f0fa66b1546f3f5312" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="909f531a11ba8ef960dbbc09c17162377d474c80430d89f4f681f62d201887bf" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="98f328c0839f662a46b889a311faadf7676ba40a6c0910d3f3359cc6067256f4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="cc3fb2a401b3358bb2afc18edce736275c71933087eed77d3427c1338e316e8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="eb2f0bcf20acc560fef6197d849f3e28ade4d454f192d67420d5364190e3fa78" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="de6ed7fb46c1238e0e65cde8c3c86a2671a65c582af6cf3ac537138ad1c67e8e" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="068fc831029c6bf98c6796d621c92334080a95ed6da2b415161887183d69c05d" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="110a817fcce86028000c96e5e5e3764a9097c73cbc085d86efbc019904f1a41d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e25a71e060f8c0eff2dc8f55deacc1ac3fc02fa238e0ebd4357f484846a57e2d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f7d1493e9ea9b204541e47a8ac34c0e7a98696a0f3fe9135b15833ee7cb353cc" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="f45c24323d6dd794334fe7a2227c4f6c0143016990045477bf3b827b9158a9e2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bc647fa08b0f842c6d050478b86ba40e49cba36928472fe705f10fafc9bacd05" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7786a908edb9e3efbc6cf8765fc86346ee0420e91757ae06b41782b15dd0e5a5" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="7fc115fff90d6fb3af395e9d7d60ad3a4f88d27f0da2cb7f59d9283dff1dac1a" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="97beed1d29098dd55b12f86be1fd9510e786528262ccfaa8a976e15a880053a5" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="7ec5f584e7660658a68422ecec882a26fe55185170c88afe59d533db6a460e78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="72201647be6506e5f93137dbe62aa15d5da9cd9d494c98995d9113fc9c20f42f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="01d27ac6b25c1558562856f550439714a025afedaa1f7cc4c332a1003cb2a317" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="538b96b349c6a7886c4a0af8edb9fd7e57277c8adf80d7806383ad834b6e449d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="d6ec812e31e6b251a64eab10792e30d21e113462f50b10f5c5f6fa954feecd57" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="967349f1c450209ee67aaf9068f56f2d9ed10753af986faa508dac6eca9695f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="b8c0138159e8c5a27f25a1ab71731a16dec64c99c54fbe6256c805fa7e39ae3f" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="3a7f52e4ade10a16a015d416c7d73c6d969cd8e8569bc98d6c7d9943ed2323df" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="65bd1344de03179d30812b7c8180e3a3779c2bc9d5a0f9a9c57c2ae1708d6679" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="930a5dada857efe27837e9cce8e363be37fad2b5c63bb2de7d57b5fa273cd35a" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="ff50c022eed599e406e405f07c580d1f4ccb559dc35be25b5923ab88601696f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="6537f26b1470efedf6178d6dbad7d32c8f26d23e06eec168ea17249c299c95bb" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="62aac27c61f68d652d53d0c0fabccbe98467de2315db76f62d2861b8d8784e5e" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="1c5d56707348a984a8168e0fe41277cf16309f8ed22c8bafa88bf9a4e6b7b3a6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="4f0517d0cbf4716ac71fa4de88a767f813b620d883ea130406fb7de5130c720f" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="22654b18c51e6e35db764950d5a22bf09200d7b5ec6ca59248a1c27ec96598f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="d4aa4720f648b876a1a593ee945b89d7af1db5ee6f24501b07ae885624043fea" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="88281f8aa3b7bb5e596d20add1e14fc37141bf2bb406edc9ca54972e1cc67aa0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="0477d0046fc57f637d16a2310ccb38931ef5fb0b8a4e612e9f5381e4059137a1" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="b3cddf3fc0c80933f15de4717bd8a9aa21524ef1f267685898afdf4cdcd3f28c" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="a26b844662b746a9eef67741d4e47d3a161b69d6dd5657761e9da8b5c3da0548" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="037fd713393ac77457cb30ea23efddf497392587e5c5b8e630149259c1ca5c61" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="86cae68089914a10d71b7c84abe27484407cbafb5e9dc884ef627b08b8b40239" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="7850cce9851c3e620a59b5bd98e07c9d9c72d578f8f1d04f2390ba119619ebf2" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="357aa9cddffc634e7d8fbb8b8967a59ce99a1ca37c5340d5ae8889596f7ba1af" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="87d8d88ed77f8ef5dcb6da7eba6b0b329a33888cb2c3caa25b330f3baa266952" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0eee3027f7c24e8d8e6201a62a3822a9df250762146b49f6aca5b42c2e4a1e38" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="4719486ccda5367e999312d9a7577ce329e86d892a296d134f5013072b0c6f66" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="41106f4563abadc13a7077fd19df2a695f678465d59c9b502abb9c0c91e4bd6d" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="248d2fc5f5956361608a17fb292e65aae25754e789183c16848a7e5e8ba882fe" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0ab9603b60fd875b76ffd57facd7935293c888cf67cee988e18def5c667ebe0a" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="91b4c9606612efdc5507ff4e4a3982af7c03be0a8724c8a6edf40dacef09cf4f" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="2126cfe2663dd9dfb6c904ce95d9168b3ad4f7be27491eebc425dcd976d4c829" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.18.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="33ea4eb4ab51cc90961ae963eecaa892187ec3eb943cbba95496a29cb3eb8194" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="611d3b156fa58af24da069e971d39665eb79babaae1c3b4e0370817f46f85946" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="91a543f88528f1d35ce378cdc6ce8d23d92958dced46de37bfe9a9c20898a3e7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="7d54e5f452aad714cff64be8a5b8b7582877467dea14909f1a19a4a11baaeb8a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="ac98abf438179cc49f7ddb43e9d817bc024f2697b3d8a9355cfdbbea2a6311d0" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="c7735404599a515eb10598b5620230e3d3e02bbd1b2afd3e30d1455705d26984" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="64fbb23b27dd8742e673b32e58d0a57cc6937b2f3efdd9ec94fcf0cc522c2ab1" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="99c67e8d4e5e38b75659a393cf7db1c93bb8332def0b0da48ddb3bbcaee65e42" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="112e86ea6f2d7229f69cc0c044aed8b6565ee2ba64e110b4bf9fc4e355e2b3e5" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="5b298fe1e5133b6142903f1dc5aba903673a41fbb08425cc11631116a89946b4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="36a2cc8eebfa76daf0711920182b825804b6f79a1353c3c396df585680aab6d8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="14bb8185439331742af0f8d50fc55c7fac357f5fe8b3a1ea5d57a50e98701237" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="81e4f27f457283202b4686d78b0fa8e3c5e6dfc7adb6204982884cc9db5430f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="9480a328dd7fb1c2d3762dcc2fa64843062020206bb578a1c457bd481ff4246d" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="e01b0ecd7aaa609c597dda7ff899d7d34196b68b4f5f69018fdac10f93ac3c08" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a3e043585684ac6160ca22bde40d162b79510bdc0a1324554b8c012e78bd25fd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="f3be338a91b469d2bc2ba3ea37b1ccce147c49e324e2f5b42e036ef4a45d46f7" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="cc8a1f8de09a3094a50aef2b0b48d45b44388ecd9870d53b41e6cee1f1c64905" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="cd9cf39882bb0da573432c89d5ce38f206c7bc381d85f68fb730cf016b9aafb3" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="8cd7f1bbdde7e1e0132741e611c8f747404738de51da0ba5200c55e6a1dbbf1e" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="ac170bb4c046979f07902cc8f0ffc0c13de865386b60de74b5d6c24ebe1381a8" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="eabc479b40922d448fed2d42c6fd0f2d97d6ff855f2d31e77517e4655acb2449" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e990e29a6267f51931df639fcce2d63b812e64fe0ee9eafb51861cb0c1bf6697" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="644cde74b1c9ed81e2ce4bb1c3bdf0ca482a037c798ba97a45820a175cf4483b" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2d73eaa599767cd060079c1a7c9cd137ad4cea69d67de49a54bcc3a3caa3899e" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9d2c0c8f72b999fd416d7d51a38da2813df5d259a050399df1c325178a55139a" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="4422768288795fdf00c2d21e5c834ca3a375e708a2abfa5de8b55eeecc5498c0" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="40ac725ca4d26a8db16558a1e00f89425d78772e626c9bad6b51ab57aeef2ffc" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="ad82ea97a85bc43346ed6494cd9d1b98a856dbe5793ef0c4f048a964c4d70e83" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="c84b93b9aa7a3f2bb413e69303d19248b3e96f3ad0cd51ce42aaf6d6c3e0f63a" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="97426157b7c09a827459195ff2efdadec3c60169d8531c10e02201cea4c2e584" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="5e622e852991b26cf4e981ac249b964fa3cde83abda3b4cddd4ff26218e5ada3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="cc690b7af5446ff6e1f1b15281c17dac2a0f88fb8bbf2286321c74b2c720aa92" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="b4823e6fe75c49ac70dcbef73e53324071ea57f0b5e9de2e36edc0579dc05e24" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a9b8ca7ebc0bea744a0915b0f2d30ba8b79d9e109113c889f2d230381a2a015e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="91a24494421318cbef9d2b5edc7f54fa4bde259a53b27c161ce1b0d4ced9cfd2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4378559cd9c7cd7efe7f1520017c07d77a8f5f11792ce53123698f0b73121701" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9cf78971cfb6b5d404deb5da57defbff4f9a8724ba8c52a912e18181963e8d04" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="22615b53553f55077373cc9200d4164a0be73cca0b484f00a2976047b27c27c8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="03da73bf3b56935629e019eb45d4059da27aaba56b4cb2b77fc677be76805a82" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="0d0d206e6d3e4fdd7dbeca84f1371e42d9d0a49c68afc00c1b88972a944ca298" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="5658c893883af8363b58d5478bb41c31bc1763b271d3dec349de9712e4c7720c" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="a820ec74a48957fcfda79827fff135ec2b3ba36859bd56c581cd4e2bc0550ac6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="c445ab575b8e36665124fb64812ed11aacf6953c998456ab3aa3d346dc78fdc2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="93018e4be194c2e6490ec243781f72bbab6adf1e0dbcb4d64021003b9a00cc18" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="7eaffde8287c830f417316051656d5a311b33273801f4be28048ee67967ba4f6" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="498e74705ad42d349c91b58dd6def13ac3026a54858c8a44765528e4b48cd184" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="a91eb6707ed4742c65f8c201be675a57c8db4e76db17e7d67c4589f3ad960db3" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="0de56cf849837f3bf8b0b0db36eccf9640bc3aa6e784e9508d150c9900cc22f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="2a74f1f9b19644e00b9d8ceed059b4a06a2e6de4f5e664c9546c31920d69ab03" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="9ac9eda6524d03a5370ae74b76b0480f5185ad9c2680ad144afec9a38c6fe046" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="11d9a007efd4c28eccb82bb50e1f76e006356c4f4d20a3dbd6f939d1d79f7d79" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="e171a275ac78264665b4c8e16f1436976c882f18a5f6ba1b42cb0dc8de01834f" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="43f23449c998050bc6e4027371793ce98041855802db1a0088ecc95fe2b96f3f" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="6aa98a07d3e0aa52f737c2ffac1f1fd800025b88e989357e6e6bf4a2a72395f5" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="643549872eb73d105747d488189c7aeed649d3a12e5109c81c494a85a1daf0cd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="6dd056bc7309aee600bee2e051a98d26d57cdc3438e5b14f6e80cf8343c72432" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="c97479875c0252b67b7795c40716ca9d41d69b3b6376c927293d0f1e1d0603c5" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="9babe40326593e59ed67fa1880ee297dd9ba2195af5ddd6e31bbdcc8916c41d5" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="a4995a8c1e8b09e8097b6589ff2f946f5386fb40789443905c536fc495fcf222" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="1fc7d93932b8595b558c4788be7b53f68167cf059251ba4cd60ac15ce5a73834" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="627ce666dade6b00a05c5bd51cb14b93ea9ac183d4bc8046e96c844d07a1b323" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="14439ab958219a6e302eaa6f0b1e4313b1e5a920a462aebfa2e26d0e50ee2d53" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="20004d8197498e46e202e893284584eb07b4da6412d9c28efea5e46b658e0048" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="e04f0427413a2e548e00aa67d136a68fa7ffc06fcbc0e9052d55e907ff1f7868" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="136ead731a8c4a444f05a96180b79f3abc4e2cc654a76219120176ffd4904d4f" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="34fab1a9531a40099a1dce992f137b5ba7e0e24b614814ef27873d8bf1bcc918" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="1c152ce9643354bb472d6d2223e931c3f8c061a3bca561b17faf910ea188391b" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="f53e6d81d448a1a3a8d80a98f65a1ea67edac3c0eb9f146bca344597463bbd7b" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="49af4c8a9d953cddbf92b15c7049699098fb8aadd5910c1daba76a0b9e486302" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="e6724f7950afb5b50d5a6707cf4ead45e4f1f45d7bed59fabc207ca4394593f0" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="cff0d5eb166982739775555ed794680af847ca6818bcf30c972dd0de5f945ba4" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="2df986d3c29663c63bd844266742980a304098879109557029c5babd872af10e" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="e5cdf8e54a7b6a05049f8ee16fe02fa1c9e89779fa1a3b19ef77b70c465f0282" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="23500b50d732c37447e3b25de15fb7220ddae1d0d972cffebcd58928912ef19a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="56b342e7749fc9690b0ce8c09ecab820df20587d3fe67ac3fd1d77baff945c75" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="d1060d724688373302d75ad610d6352054e6357a673ad387e13114764c870818" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="4db8aad0fca0e248d69a4d06a1a78ad8fc328abf4cafe929f5b178fa402b2ccd" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e21c65a7016c1c8e5e38af04478a8d75b2a51b7cc58a4b758519fa7b2f61e8c2" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9b36b325b3be8a435555c0c131fa94c915f3494440fb41d7876db7c91e59f177" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="990dc4861f6d59cddd454069399bc313b20574639ad22e80e6452bde481dd87a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="1b6c20da66df1297a939f22c745a14f1ec16ccaee099dc8e7ff7b6aee2774d97" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="c97ea79717d56c307ddd947ded2a75ca7e648cf21d175429782f64e4b09de286" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="39764cb75416421ed9cd0d05632bb4ee3b9d49ac941d3a9af1735b6d2d87c6ff" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2d66b1fe6e1e0c24d216c53a9a8ea44eca5a34d54e5337c91b43be0609138f15" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="5ba196d9ba33a252c610bc3166aaaca681c7da48b6524d2eb1117ab8d7da6caa" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="52ed3a67329b70a1f5551aa44d7597b2d1b2f8ee5465abe9fdd91b234ccac211" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="e0e711df89717bbaf08ea0e478d79f355675ad697c36f7a3754145b32bd461ef" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="9ff813f46b213ede00a1a27b21db89e1367e87764bc28234acc14148d7b0c929" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="db6bb0430a8ce14a9d94c0c851d9cc3f9e34d4f2a4a98962f909f54c75e32e39" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="b619db515a9f17f66bf0c897a81b3ccd1c3f19f03254f7f8ee754a53c2251b32" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="72e8de1214271dd63914b16455ab6e8fc8a6eee7b449ec230a077114e5ad023c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="38c9b6cec1929bfa81e25b6d12eeaa6405027a5b92ea1f392a40f4762f7a59c7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="4c7daf43b9dd430d737a5c2564e8c985a72dfb4c5564f57d40a9f21888768b0a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0b4abb2816b124373052d1d6b8370136f6ae87e194162da8bce34c01b136a5aa" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="625fe220d319a75461d51aaf1ccb606910ebc642301ee863a613b8b6929d52f8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d239168a9ba82d08e37d384e2937a5f3efd7d4de49301d4d8c3cd493988b1185" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="b6b3147537ff9bac7ad826e834a5f8e88e832d056798e04878329d4adde0168c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7be8cfedb8b1891ed42e6e9edc80c94982c0fa3db960939974082b24cfd516fc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="343103d1ce481d13ada5a84673df6c3e154a1f1fea776f97cdfaa6605a09cae1" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="268f2255b7c2e395e1b25ecbe5bdab4172fb8c3ae1f58caf32db467ad4669e12" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a221018753aef499f70b3f37547d23bd2e46236038685cd9fc42f5d9640bc23c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="9710540ae59d3159ac72b55a0a73529b0c2b5bc6cb0b64e171ec2eeb796a24f4" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="40e76ecd4d8bc783882587acd620fc87b7ecc2bd93539035e8836bf6b8d15585" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="bd46767b26ebc0f6dc9275acd67dc3aeedebbf011ecff08d0635a145ccf3a533" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a5636e2df779e66cdcf6b4d4c925667bc44eed34474c5ce407875627734eea4a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="7119001074f088b1407813218193b24f988bd4e6641a21fde73bf118a3a2cf11" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="eedbb10b367229e376c08727a103aa664e96f4df1b044d90458255c02dff3efc" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="047913f1e44a15ce51a3753abca639cc8f4637a3bb749407d77d85b117fa3829" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="ffbbdcbd1ee0695a33a0f3e83adb8b6769db79d020ca7a6bdfb02b75b8aa280c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="76b33371d774672c5a51ab5178a026eac7e341889907026d8fb83e99e16a8869" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="8e2309f36af53fcb1a838d64129c87507815b3e28ee0542d2b7a9c383cb597d8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2d9bcd26697bd3aa57e913508a949d0ad7f2e1068e3812e7b1d6ecab285751e7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="b154a0e9a8660149caa537bca89551e58ee77cd257d8eea67e5d7324c199e21d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="960397764a546af62a9b7a9983bb55e0dd8e71438a6533db602454c7066b1389" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="03be066b61589e6f48ec02ff1718bdc59b90c3e78cc4ecccbc2d7f43b48c3fc7" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="db76816e21bbaf72b52c1dc04c240f18eb6418ab16b64183349fc9032c5f0e72" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9fcf40cc682e505cfbbc2113ba7cacfe9e00cb14fd842a00e815786c0099c1c6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="a3466919a2920ff616b96ec13d02844e401dd42bcb8f33f5bff9bae32635bf8c" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="51608ad363fc3c9827d5d00f29e5f90d6a430e36afa00043bb2b98de43ddd031" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="c776897d9a233005846db9df632247b6e5b04b64932489dbc647e961df4232bf" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="4cc817d3a854a1ef95a02c93279c9b820e516501bb0b4548ce047bcc8a0c2c61" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="d45174be044d84824d20415c773ed8eb06d39c4510b0f9bc6850d1504ffebaeb" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="c1b479cfe8898cf5b0e5cf91df10548ff94f422ec363af1f2adbbf5a833ab969" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="490998741c59b4fedf737d778a9ee316ef61907bd58f8d3e9d7c4846c3f0dcbb" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="49699b1877940916c9b22eeb1f22dd4eadb7eac8748b8a94e19ff603219a00b4" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="98b8d0cae6f24d37b82205357c013e2b46980db20b83eb8e4f3bb834ab861e41" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="beaa18d95f51a6c0c6dd01d6cdc0bf496a498fee0572f9bfa606cbfe7428479e" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="ac7c3c5cd5139fcbb5f6ec6065d2f6c293099b65116c46bc27d58e4f95923f3a" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="5be6fe5f1369b7455580ad3a0e7cf4c3571779b2c1d04f1fea509c4f18f741c2" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="9ceb17fc8f10dcaa219d17becb8b0b8be409b65aa46f1107e5bdc074b3d21a7a" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="fa0946741b16e4ea7109f674e86f188bd60d94623717410caf6dfc9bb2afced3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="55ee3f11f61e2e7b06a3c3a000af3741e6a68abab41e1a3cd23d91c77b8ba490" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="655a8bffd2b7d3d01e048761c34b6009d130800e11c8dcf51006d5615ca23699" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ff88ce2f291306db139d24ffbbf656011fdb1d28fa33752b2675e03f39029536" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="e798a5fe5e158fdf479ec970d07fb192d15aaeb84cebb29bc97c47f9dd951e1a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="b9b38c60ced916fa7baaab7c8db25575252dcccdaa7508ebeef68ef3de319560" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2ccf250117e076e71bc0a7282511be4eead3e2b40f6b4e9cb1dab4e6fdea08b9" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="9cc114302ca475194eacd30c57c5b1e43a5754a059145442625cc90575e7c5bc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="887d1f49d0fc9dac0b4769b541d4c57268ca2b2320dda71d15bcb17669ae6895" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="6123a47d5655bd9fe3ca0c7f33079da23557bce32f8a17df514711b584bf819e" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="3af5d9a94ca2cbcc929a6789a7a32810d267a0d8f93a3265b0f72b531ef6cbc7" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="c879de380ef4dcec2ad35ab21abb2f2569c6c00b4dbe50c19ba1d4bea26c68e8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5d8b9f52e76efb05883c2841671ab5538efa200e86c9abe9d3f23ef938c5a1e3" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="9cace12134e3e161691bb0bfc53188d166996154d1a3c69278aa112f3763ebce" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="525be4102969661c20f21317982da035e4cfadbd8752dae3712bc13eab59a8d1" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="da6032fa65e0df2ef2608d065f626af25b4231324679de1b4a30044511e92987" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="5151b9f5f0628c75f41eb1875db7ab13cdcf7d92d729afef555de85a80c7c369" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="d6133a2579f251e5df075ebc3fd5037dbf56a779902b8b756d7c3c42b2d270d9" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="256a454b2b5ad46051cf97ce4f841298359a8e98f4eb55cc9a1bbc09380633bf" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="a09e90a2b68a6d178de7ecd1df020598653430c6a4cb8580a3290248329e6a37" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="81dbdd8c9e9891a46b76a9a01ec0932ce7c413f75cb064ea4bff47dfb0f2532c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="17551445ccce522d9c2fdbf3c25e78642cc6f3771b7188fb6193bd5fef6f4086" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="adf26721295bc2ced17ea84b4fa2dcd86b92c38047080aeb7c6ae8c631d2db00" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="cadd96b12ed3ebb4742229616f185feb4dec60b43eb708734dd2aa3474c8a9da" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="157729dbf6a965d54a85ff305eadcee044853084916c01666ceaf371d770b984" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="39b772109c464850915ecd212546a011c11ee970c5e88eb8aa25e378f021a80a" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="8f5ac6051836204a8f4457fb025640c2087edd025f4eee837529f4e9fbc1f0c5" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="9a35014d0999bf08570274ecb41ef6d529e90701f7ccb6080109ae1ce0395c53" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="147c224efabee109d19ee4c2b5d288afc65878cf2ef8304d19f891278a141b5d" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="742815a5557ac2b2185a06729106600daa4eab73dd6ea8ea6bd9cfb57217c946" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="793d47abe06d4474ac7145a29a13df0fa77f171bb5c414cb9093b21c5ce0442d" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="4b59cc95780769fb8004993d76d4b853b43058adf680257674f06340823508fd" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="bfb9fea274045ed018f8019213803cc79fca5d309e94dcd31e7cba0ed1afe0dd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="82df70694865d0df0a215345b32d14bdbd5c036deb02592a79a9be0fc93e503f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="08c7580f7f4800d5f75ca922eca9e9b480814c47d7c5a7db0c22d1daa91cc349" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="13a5cf01a896d0af22c397c7978dfefbd6e0b5c47da5ea2fd965ed364b0d9532" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="72967cd2b217d78d02c6305ed0f22a84e80591973cbad7a1662b65fd6e2c4026" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d64997d19bb0561152de9d518f4a5d38f998f007857e56650aa60cb4661b2593" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="0ac18b62f170b14e4d2d4313d9e6912c0a484955477571000a37f7e27e3e227b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="a97ac27ff5644473a34e13daa5fb251176b50e14f78bf74d49038fd0147aec68" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="da21f420c8cf8b86cf69eb05229fb25e08ceb1aef97a2390b404c13fcc161ae4" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a0cae92332a81931afd18a80e68f9a5840e3613b1113abc069998e2f812782e5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8b635114da54b446d4693e758a1851d30742703ac8651ee0fc551fe182b7ad83" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6944115dcb4b6aaa8a221dd4ff8616c84cf85a7889f7a0d7823148460e7aa8f5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="fd668505b6057cc86b31dfa3fe7390c6172ca51efefe931ee37070bb44407fd7" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a60a5cea901cb80645967129d9a7cf2465a339368bbbdd85707eb26a24da58ce" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="415cbd152229a6bcb3ee1dcb529e8f67664b4abd78a44116dba9f4e5d14006ca" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="2468340a570ab0d3baca1048a90d42f68b82ff05087cf776ab38a8badb0f2c47" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="bb577b9a4eeccff07d1de6b8e739f1ee4e65b4614e717432f63bf3d56ecbde8f" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="23125122503a5a31500092402c8c80a094553c0a563315d4c131e989c9cf08c3" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="c30bac4d088e6bf1e194c55d97b749d6122a1219d9d7884ef9470368dbb0d6e1" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.152.179.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
</package>
<package pkgid="04fe6742647e51cd5e081422ae2e54f008b7a441352bd15acffe74f5cb8abb1b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="267494bea152c08cb53eaa1c29d44c19812d68d4c6461589460af3df34cce6e2" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="b04fa186eef4c6922159a07bb42ea7411eff9f69c2e5d2bebf72874172d88dbc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="61426b6e4d7c0175468e9c4781bac6bcd9cd6a158942bf0ace9998e104c8c097" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.152.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="6323ad55b33feb85743ac2ddf3fdaf20097d242a051dbb06323f3ba4aea9d3f1" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="d0a26883fd41506708eea7e874d6e88eea98096641fa85d12e49acccf8e178b8" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="7fb518381b156af1e6d214155e1dbaf17c9ebb156d350cccd0b5ea666f2ac9e9" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="83f803e3a19eb21e8fc73002644e11a87c202990b48286c96960d4f66f372189" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.152.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * MFSA-RESERVE-2025-1962421 (bmo#1962421)
    Double-free in libvpx encoder
  * MFSA-RESERVE-2025-1960745 (bmo#1960745)
    Errors in Devtools could have been intercepted by web content
  * MFSA-RESERVE-2025-1950001 (bmo#1950001)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1962301 (bmo#1962301)
    Potential Local Code Execution in “Copy as cURL” Command
  * MFSA-RESERVE-2025-1965628 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * MFSA-RESERVE-2025-1954137 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * MFSA-RESERVE-2025-3 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * MFSA-RESERVE-2025-7 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="47ea5cc0a72086598853e50158538efe9568be223a8a7714abbe2de8c194fcbc" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="d70757fabb42b00a16f36995d8ef5ca6cacd4a385079e0cd81bdee9e2ff5c31d" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="8551622a4862553fa6d698cab53baf5a2763a699c60cf2ec1726e714cb77572e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="7551c34b481f2707869324851f73f6ca1902104691aa2e70fc6178c70eebd321" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.152.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-22 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1745409600">- Firefox Extended Support Release 128.10.0 ESR
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Potential privilege escalation in Firefox Updater
  * MFSA-RESERVE-2025-1937097 (bmo#1937097)
    WebGL shader attribute memory corruption in Firefox for macOS
  * MFSA-RESERVE-2025-1958350 (bmo#1958350)
    Process isolation bypass using `javascript:` URI links in
    cross-origin frames
  * MFSA-RESERVE-2025-1949994 (bmo#1949994, bmo#1956698,
    bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * MFSA-RESERVE-2025-1952465 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * MFSA-RESERVE-2025-3 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * MFSA-RESERVE-2025-7 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747656000">- Firefox Extended Support Release 128.10.1 ESR
  * Fixed: Security Fixes.
  MFSA 2025-37 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747742400">- Firefox Extended Support Release 128.11.0 ESR
  MFSA 2025-44 (bsc#1243353)
  * CVE-2025-5283 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1750161600">- Firefox Extended Support Release 128.12.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-XX (bsc#1244670)
  * MFSA-RESERVE-2025-1966423 (bmo#1966423)
    Use-after-free in FontFaceSet
  * MFSA-RESERVE-2025-1717672 (bmo#1717672, bmo#1792377)
    The WebCompat WebExtension shipped with Firefox exposed a
    persistent UUID
  * MFSA-RESERVE-2025-1964385 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * MFSA-RESERVE-2025-1970658 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * MFSA-RESERVE-2025-1971140 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="0c12aeb9567da70ec4a7cdbb6ca99e01fb4cfb5e124d166f352fee0970e03ac7" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="0cbcffabf801a49665fcad5c0ffc82f176ed5928c169a917d8f1da57f4313ab9" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e627135f7b7dfdbdde39b152e5b960d8649b5b47cc8d3dbafe56eedf6b18ab2c" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="80b1af2e7b84b2bf9c80b7676e0da031ca594d8d285dda038b939d43981f735f" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="aa7672a8893da6d0094933260d1d996f8457cb3e7ef19184ee75d586ee37784c" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="160d9d66aba543bd9e7c06563ca658a1725d091b0421d2cc3aaa548026d41688" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="f43fd26c1331db3d62f06754033801f422561804ba17174724e8db11e7f8a6d2" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="abd75851c87cc60526446ccffeaf6aaaf969698b198b965df98c9d1940f9d973" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.152.152.1"/>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  Placeholder changelog-entry (bsc#1230979)</changelog>
</package>
<package pkgid="6fa9dcdf36aaa0a8b3566fd844aa2286906f8096c56ec462161be4aa9599da8b" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="ed91b2c165171242619debb02b0be6713339f5be6a6ce9c9c2b1c563729fad27" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="090a425d1292b3d07451c35fce71054b70b1b5e18fee7221dba32aacf50120d4" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="3f21ee8e9242ac9cbc6e8d8ee03ae6e0e761242e509d6450f03f0cab9140b432" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.152.155.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-XX (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
</package>
<package pkgid="eaab9cc8158f595946a7b85843ee05cf9f7e775a94e46212393d42835be1e0f3" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="f86c008eb0b5762c053ebf08405ec777f52501e095321c5a2ea535ff28ad6661" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="2b9705f242cac4e3471a6be0eec51c0e88b16337b5572527fd88d8ce0c7c9706" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="35ef48302caa31c2b58fa9bc71302973628db2037d8efe1bff2a8a35aa68f2e0" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.0" rel="150200.152.158.1"/>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  Placeholder changelog-entry (bsc#1231879)
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
</package>
<package pkgid="72b6d6f4597531c0b3aefb740438de5908ad96ecfa8e0f269e0828660c42aaf8" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="0a029021b178ea58bf77a51831ac154cdb3a314a1edace2540cf4a57b3d74dcf" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="bf2e830ae09742cdb070a7c4fa66c4c9bae575e456aa6001dd23c9cb85a66246" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="ec647722f42ee15d929273c30116443dc587051efee489023eac711d2818dc9e" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.152.161.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * MFSA-RESERVE-2024-1924184 (bmo#1914707, bmo#1924184)
    Memory corruption in Apple GPU drivers
  * MFSA-RESERVE-2024-1909535 (bmo#1909535)
    Select list elements could be shown over another site
  * MFSA-RESERVE-2024-1921458 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * MFSA-RESERVE-2024-1924167 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * MFSA-RESERVE-2024-1925496 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * MFSA-RESERVE-2024-1929600 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * MFSA-RESERVE-2024-1842187 (bmo#1842187)
    Inproper Keypress Handling in Executable File Confirmation
    Dialog
  * MFSA-RESERVE-2024-1916152 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * MFSA-RESERVE-2024-3 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
</package>
<package pkgid="82e334b871736e59a86c024b6d3211d10bb27f85c3830fee92320a9c8f616a50" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="55735ec474002d058f136546ec6629f96e26d67234eb39a12eab173475734b46" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="c8b9fd7617347d4dbb63c9fd1d5afccc455fb239a147d8bd9f6c1614175f1f9e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="5b804eadb3ab98e05fde8bc52da3c20c4374a18f8373e2fc4f887a0000a6bee3" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.1" rel="150200.152.164.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
</package>
<package pkgid="c21fad3209b97e210aa84b898cf56b0b39a08597c86eb1e82e24bbe16afac2b5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="be525cb2322b0d65b2cd5076b53c47209b86dd823aecafb7c869c9d008746a22" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="492987a009c79db24d727d5123eb126b730f3b1a7776049dc83d29588d79396e" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="c6c68f942933a7a5055c8c72673cd90abebc427b8eed1b78a840bcbd30eaa2f7" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.152.167.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * MFSA-RESERVE-2025-1915257 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * MFSA-RESERVE-2025-1915535 (bmo#1915535)
    Use-after-free when breaking lines
  * MFSA-RESERVE-2025-1929156 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * MFSA-RESERVE-2025-1929623 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * MFSA-RESERVE-2025-1933023 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * MFSA-RESERVE-2025-1 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * MFSA-RESERVE-2025-3 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
</package>
<package pkgid="fb6c4fdea7de6b85a97de0750dcfe041f70c9ddff317492328d3765d11844c66" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="d2c99c228efde1e85c73564448a4e71713c8e27cc36a08e3ab031dc9d1f1c44a" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="244cf265df887beda0c517f0719bed26e1cbb86955b97fdb4f34b6f68b759cd1" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="44c25ed9338be30ce755401bba73ebfd10a0912b377a9276b6f3d75ffc4b6500" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.152.170.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  Placeholder changelog-entry (bsc#1236539)</changelog>
</package>
<package pkgid="d8efe2b9469d5bc8d76af928fbf4d51cf90eacf03ed1c529c357cfd11f9375f9" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="a133157b04241b46edaf9b0d082fa5a04ba8de09f96e485e38f267db909df8e1" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="aee864b5d23f7dbf7043f819dcb8b172527e4ef9eed7da4ec5ec2c5100cef819" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="8c4869e23a7b22b54789e0d335d3c73aeb48fc9eee36909a444c00fdf7820cd7" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.152.173.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  Placeholder changelog-entry (bsc#1237683)</changelog>
</package>
<package pkgid="94aa26d2f9778d8dea3fe485e0849a322057c9ef6469d252669c06e1745dddbf" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="66b261de8ed7f5846d0a5d88db84db05d922caae9994d1d1fe6d07450c2adf88" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="8a1d6b280fe364ccc8acc5c910bad9b28aba761af04eed5396acbf59ca5303b5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="c7f220794b4f47b7e265465fb7db974e7c9f72beadcd511a3d1eb9964952363a" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.152.176.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="cgrobertson@suse.com" date="1725883200">- Firefox Extended Support Release 128.2.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-40 (bsc#1229821)
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8383 (bmo#1908496)
    Firefox did not ask before openings news: links in an
    external application
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Firefox Extended Support Release 128.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-47 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Firefox Extended Support Release 128.3.1 ESR
  MFSA 2024-51 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1729598400">- Firefox Extended Support Release 128.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-56 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4
- Rebase mozilla-rust-disable-future-incompat.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732536000">- Firefox Extended Support Release 128.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-64 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Firefox ESR 128.5,
    and Thunderbird 128.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733140800">- Firefox Extended Support Release 128.5.1 ESR (bsc#1234326)
  * Fixed: Fixed an issue that prevented some websites from
    loading when using SSL Inspection. (bmo#1933747)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1735819200">- Firefox Extended Support Release 128.6.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-02 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6
- Firefox Extended Support Release 128.5.2 ESR
  * Fixed: Fixed a crash experienced by Windows users with Qihoo
    360 Total Security Antivirus software installed (bmo#1934258)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Firefox Extended Support Release 128.7.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-09 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1740484800">- Firefox Extended Support Release 128.8.0 ESR
  * Fixed: Various security fixes.
  MFSA 2025-16 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742904000">- Firefox Extended Support Release 128.9.0 ESR
  Placeholder changelog-entry (bsc#1240083)
- Firefox Extended Support Release 128.8.1 ESR
  * Fixed: Security fix.
  MFSA 2025-19 (bsc#1240140)
  * CVE-2025-2857 (bmo#1956398, https://www.cve.org/CVERecord?id=CVE-2025-2783)
    Incorrect handle could lead to sandbox escapes
  NOTE: This only affects Firefox on Windows. Other operating systems are unaffected.</changelog>
</package>
<package pkgid="440ab4d47fb8d6b106da36b59ad4c2cf18d39264007bcafa6e170450b35f8049" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="2785706ed159bd4a84889ab37e9879c68b9cb74d392040c9a1c767c725198f5e" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ac60e564668ea51fb5d84baacd67bab08ff315d1dc707489d05400cd08601937" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="edfaa2767cdae9e9b162e73263517d8dc08317fc6db149703dab25f2de08640c" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c72d621dda3b060679acc7ffd2858ebfa85d9f5039690432a6658b2139db9431" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="4af78d4e6abb584c16e73d7fc18ef4258d1ee0751e54bbc814ef879d09e0338f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="232f22c91f9550b3b2d049b1b04367650551c534bd9ffaf66473690162b4b5cf" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fef1f673a8f92d9e63713d45f6ba3f24f3ae6b0bde967ff4320defebae369c4f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="be7828a2e17adbf4d8dea4e64edb01d97368814e4b90f9aa74c19889cde42fea" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="5a2ca8f2ea7bece457e36e5052e363111fda2f942e1a1fbc48a062ec4da8e2dc" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="4aba2662d9efa6b8cafd8adfed9c158e733e4fa82bb0f75c80bfe1771973ce94" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="080854a29d57db54c8055151076246ee21f7aaa0a89f1de7f19bce45b723e55d" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="e832999c38909ecf7c7d4e9c005c0b08530b64dda69657c243b3f50416468260" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="166e1557854f6883148a1b23e07d919bc66d6c0e66ca4f29b5a989a4973c7d24" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d644a0bb8be1de8ff8a175dfa1f20f87ef49912f3022a62b4e48e739d2aa6a0f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="5d31fda063fce4355835f1a910c1f118bd92fac47cc6900c7d564c5204ff980a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="21825a5d9b0908059ecfb37722ff11c0c8216ef84eca2405cf369b5554d55d98" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="46b3fffe0d1ae59a4141aea1f380a4b7e6c959971c859ba0663c1dfd9c60de2f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="1fb033d19af5bd3e7675b16a16017f2d4dc813980ca72dc93e6f85a66cfac1b7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c63c404542a7d4967c5f4ffb0ed0a98bc2067afddd719598a5e0e3800722ca50" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9039191fb4c8d842c321a3d138d6eb8cf74d19fa84e83630cc70d00ce57aca24" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="67a8fcca46fbf7d7e4ebbadafbfd3f9434b7620feb26fdac8af7a1336859e406" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="30eaf460c6701b109f4b59446ebd503f5c8a99b892f3c673d557b182dcb27090" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6673b5fd73ff6c8e244be8183fc5ea13132f3821c6d968f8d7702d6d1412ec5f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="eb2823755635b6647febf2d5636880e4ee0648e89b985d360f5aaed5a4ae4faf" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6701d0913539cb64c56165e383b59c35d300e90454eb744671e53eebe4f9d7fd" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="89fb85373020f91aae11c1313fc96bb686c6a293e590d108ea82261fc9535060" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="ff137fdf06d63ac86da09ab200a285d1ad4609aa571335783d370f15241f2e53" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="9f6c18182c560b07ca477e978868c33eaf20c8f85c8c0ecc85ca3a3151c9aba2" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="8c08f6875e40817c53ad780b20141dc90569341d859666872ef0c8d005760491" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="f346e16ee13e725fd9e42713d276294386bf2d067a3534424e968bf748cd3129" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="ef2c118657ff40459034dbe7333fd463a40d3419ad5089da9408740f09362942" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="20e6ba66069f3ec8824dfed33449653bcee0bf20b6109dd09f659f28f28751e1" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="bfc1cb40443f265885a0019e99eb2fe26d63114dde67b64fbf745548b45a3810" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="9f6de43fb5e9450dbc0f892203b0f18d837619cc36a1d80cf2d66f8fe3a0bca4" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="423cb32ca19c24416e3533f962b00aec34cc838fab10185d13a0e2f414a5e7b4" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="403ac34c179af912aa8b056b868cfbd2732bb5e4c03c8cc1aee3843b68819ab4" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="adfb9846cba6ef2bf15ef9258d38e2365984a47abab2a2386d513e503fee65a2" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="d07ba3e869db22a3bf765e79a3fc752d122f5eecede5546a8d005ce1db27141e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="7e6f09e20a10e302064c31209f270543e1baf60114246fbd7c3708e5000ad99c" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="100e199207bcfc9e4b2d70e95ab68044a872187f93cd2856a67ea5945674c891" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="91e43bcec3dc9fce3554dea0bba85513bb6003c4d490bf2598c64600c514bdf8" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="19e6679df2b34951d930423137c9aa06e6a94e54fdf010bbae9a80ae44083c0d" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="056a6bb7c98a1ecde1b8c779a43b71f20c9940b9f2066f5bdd77385de18c5a2e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="1b5940c22e1f439fb71453bf74be92c006af563a26296ab5127e8b32894fb2ef" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="6129233ac847728e2a5727f17eb7e87fdaa83ffc53dd025d963968253bb2586f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="914ce31b709852127b5d418dab80e50197b1f4dbb825aec2e1059258c015c3fd" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="b4fdc3290c0220dfebf9ef010090a997175dc93b41cf8024837b7b62fdbb692b" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="3e192d647b85f8d640adae9018e78562149c725aedc8ec377ca98299b42e5be7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="9e59931de179f46d817f9eeb62f4b040d29f73afd7263313f777dcf1df66461d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="fafe386eed03fa0e90080bb5b6b9af836b82eaa4f7829fc5cddf549fad0fc175" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="80d6aad562ff3e3104434b80ced32b19129190938dc48551b69c3f41dbe5df62" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="1f656fce435fddbf419d4db9620e29e8a8044e31e0066f5d8e47a1d982f295d1" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="8e65d8711855e43451fa5d81a7d23cf13e9d6dde5c293614bfe0b6539262f33a" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="945912d6e6a929de689089c5fed558006ac1da00e79cad0a3d37b6e70be5f9da" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="f8b087a9e5cfd3ffdef9919d36c1e52141c8bff86860e2ecf9666cb0fb0d7aaa" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="5e5bb6da4d5b120950040a0524497aa90ba27b60ce5fb0c7d831cf66b2a965d9" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="23f10f140c1490f58a5ae851d38508595c76bb1b514b21d4ba5761690e84f357" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7b4c2bfc9e276676cf963013acff63689044c8b0080631a02252d3fdb33a9a55" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="9252adb5f9015fd1272cf40bf5aac0bc93401ce7ff67315e22977b4f1361b0b4" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ba349cf0068a6b51f9a817e629996db54b41203dc519b93e8aa7e9f56e7c55fc" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a8dc4061b9d9539ec0127d9b27cb3cb0a2399a3a7175a9df5ab5c6ccdeef2554" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b3e490a0730ce7c509cf9579fcc49b89f1a0cff1aecf623da18107d933ce79e9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="a9b6e34c039a9f99b451eff57d8b66987eb3597be6279a9f08422ec1a7f3d242" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="e6b16956208cf5423b0a882fbee5b3efb0bec378cb5577405d485ac2a78c45ba" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="234313cef37630c6c3358600585089166b3c219c8cefc541a4a1fac5a72f6e7d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="efa4482675e99d92f7c911d7998446872e467ed1d6114f6356e35e61f6ae7e8a" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="314f75dcceb101d98b3416a17bafea7ddb7d32dde28c590406fca18c27449134" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9ba3776caf6e90e69dc0ec4f5ac0b51a10105ee3f0dcdb64658c6fa7b2084346" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="c66ade353bf974a6b53df2658493de3412a116a2731be2a153eafc0a4ce7179d" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="9c981842de1e4fdc9539bb3db12d0aab9c3550dc9f8e7e31216bc31797b67f4d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="da3db84fc84d6b1a138eaa80a751c844609869451a4b15fd0a965e988b98f5eb" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="e38346ab9a3d2074b15af67953691b9879e0dc7247010d7e1b0a0d198f999b90" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="92b543ff65c805f4a2e255d4f5bcbb4e507f7066d3b4278fef642f429b2dc53d" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="b67e09ad92610442508254fec9706db6c7e530cc88922c9d430a7ed787f200e9" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="a2d9a8a7957be49cee5ca4c63ba331be73a4567b68ca58e25f8d6ba7e1b2c4fb" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="0c2efba0c611f63f8d3666d6dc620b561d7a40e652f27f8df8189bf30213074c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4cb03a83b0852676d712cb1270c71aee5c07a2752f342a78236d12ab5fbeb6d8" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="b845adca41f605f61ec3f8366760fb4b09786179baf5fa5d7f1efc086dc797db" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="37325beac5605a8efd501a114a3cf9e80917ab0dfe651e45ff99a6cf0c0755c0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="bf4e36128c3480a0a09ce4f95cdaca338087b8b336999e3357b07f0acfac5f02" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="e3f4dd5827f1203ea2ffc1de25b4f1e0729a25d490115a9506589d9e3161d97c" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="04c6baad8efefc96cce30af21afbf6e597d7a172d088c262846d9d0fe16553bb" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="bae2ec24a4914049ed27f6366b24ae6da3ccd21d1b0d13f4045444e7b1e61841" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6de88bb6dc15fd73692e459a52bbb8b0c5f23edf84f5c0c959b13cac0a73bb19" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="7896379128381de5addbbe97f88ff671b6e7c7ef30dec23a9be1e1f67a000eb4" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="1b95392fb5d59c925b2adb3ebf52702f4041f46f658ef6bbeaae8d59eb8cd8f1" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="e4a833efe0b37248a6a5de36d2fedc29bd65ec1c6c292ef2d15ec8a749586aed" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="fcc5fc4aa7627db18a19b6f61837c92a2e9d6adadf2dde3f09b61986ae397bbd" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="db6aa5c43339c469c67e7c7e1813b9d9da5716181465a20817a8a07e9acb30e6" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="9aeb35fb9e3160382e50c9d674a6d7f5e73bada9b7e4d1b33dab50e546e01196" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="671fd257ecffc64ecf98b2422b56560df5b2c7961c14c8f3e763ca3665de3667" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="1027e1a8e4d8b8105902aeeaccd557c4231a735ca98b1dbc31f1f8b85853d6b9" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="ad05db7539eef95359bc90ecc831c5e22f70bc79a3e3b87cd786fcdb0f5eff7e" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="903bdea0b8a0e5885f3e66876e431f2d4b79ea475181cb19662deb0e117712be" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="803f1de0819392c05bbca0ffae4b6794e87907b19b8b22dd1c25175acea8c2be" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="34da3f1531be3006a261d6b4550039a2c19bdb802fe7a6d68cbd63d2c139e0f3" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="73f2669940149b5a67e40577495a3ecbd9d81e99757eed7e58db1b92975feda0" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="69aef5192740c965b1f0e1da4876ef02cf0755a2c5bacbe127fb8364ab55d5a9" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="8ee789dc23dd76984dd36c187472cb9ad60ac3ad7b193258f119e9218b9c4a6f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="e2060b22688b256f5d3aa775000870a3d89149f2732e5ba94616f5798cc0277a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="c49c785e8f052a241b593bed61bb2d0e62cb069a65c34b8c4673a50d86973dad" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="cea624ca676c98078058d2b2cbb44a2568a3f6172be44853507f728ec2286005" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="946955dfb1d73e933488c908df02112bf27067fac1096fcef13dd67eca93ef60" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="94894bdc6a5cbd2b98fed436d177e66c182fc09a9872bf000b2c21a621184406" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="38f5a6bb421d62d2f5312833104925ed502f262023da9b2b23fe28d3abbf3243" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="56cb5b602145db22d448daec2d362354a078bfebe606ea91f1929e5c261715ba" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="2e85b03c032fa5c6cba7e7f07d715081c9c84c9a636818c82ae62740e6d97970" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="cde746560740702dbf0dbea0ebb0cda01495363b9d57951b6ef876159f37dd30" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="b98c0c6b9953655b26592a2c014f39f5c8a9845c6ffa9743a5e400ddc97e44c0" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="3f44fe92325e27326e5e5381e9793704c716bfa8f458b79bb0daae3a64c81036" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c74846b309e7faeca7d7743a7f5ee0ce82732e25595a473db5bf587eca2d0388" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="64076a3397953ca826ab59864999dfff79de447bb7df77f46efaa56c922602ca" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ad20d9314a9fe71c53998a8c7c5211ac74a4a5c2c13c1f02f2c324d28a114f61" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="94be601d129dc8970ec4b926b83e0e9ee911b2783aab87e43dedde4d6194a9c1" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="523ab9217c8743ff8460286e27dd29ea35be4a651c5102e0474e14335de1a591" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fea3ba88a40979e4479b90fe92ce6b17307c4439a42a8bc056c7fbfa3ea80559" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="02f4ab1bb8c0e8f81b3914efcc7f65af1478e03377dfe739391728d3d8aa7a0f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d49c5ec1fb4764a960a30d2a1e1aef53998de5f08e998344500697639f1ea7b9" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a2b2a1e0838837b666f0002057f5ca571c4f35a87026320b4932e97575dd8fc8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="42fe4dad76f7d27d578cc475a9eb196e637ae3536876a11bb4b28ce76ad5c054" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="928c05317251699f5bb2b857baaaff3260cb694eed69dc14fdfc71b439fd8831" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="dcff77240f40a6dfd4571554b96753885c32044ad4c5e671e2bdd240672a8fe8" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c60c358e1a5cb6b92529cab5458c6b86d418c1f78fdecb812faff0d3b7871cff" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="a464c1157c1102525077dafed508a6bad2b3178456c6719680e126caa3cbed52" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4ba9235621ccaac76f35971503f88e6607e1fe897dc817d6ddabdc25dc983b2f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="647873670a57858b2cf7e06a704446854e3ec6d3b8ce617a2ed87225d8ae1c0d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="78e6a358661d7bd74c5cb40c91d74b26dd100fd9e04a141b3d1584cfb61d7ca3" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="04a835b71a0b92b9f5391a65de143071a01d77645721cf74f748adbfc167d6b4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="f9ba4cddbd38e31ef4633683f346c2a77545791d47f23e357872a1cd2af11fb8" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="dc3ea009c0e768c6d2864af57d22bf4160d6c57d2fa4b46bd4ff1546fdcc8a35" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="9e73e14689f893be9eed9d746c4c082062eebeac0c670d19c4fdab8ff8d6627c" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="53d6a74c748b467d996355847093d38debf8287f129f441c91e94e15c4474810" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="4699d799264a80dcda7e4f12569a1bae892c50fb4d8127a3d6b35257bfa67ab3" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="a534fab89bcb779d6912bb5e25eabbf529758a2a9d4950844233b0b806a641f6" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="87515c4f5ff0f07c8f3268e935035d06b0ffe40f704d1c8957eb0379df34a9fa" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="5e2dde1224a101ef325649a33145be4b9d4fe9bab8c4f799be9092273e7e6ee4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="bc08fd745a6ea8139bb0cc0ab0af18f49242f69e6ed74e95134bdfcd1c6510c0" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="14d8de17835b7eb6219168d8f4513df30e287c0ac24d9b6e68a6ce493c53e352" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2657200e41400d8445d967afae2877974c25a83529214e259d10439bf2f00f5e" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="e313137e974c103353dd2121f641cb18e418d472be73a7e2909c99743d2ecd8c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="43b10e0414135c3ce0b2051b2814a33971540049ccaf7b86f86eff0cad427500" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="18aadca824548bba57ba374c1bc7635f13910a85a0fe3bb77a1b65522293c116" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="0040e920e06669c4d8b2043c9b2777634fc8c13cf473728b6df059365893e045" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="04247b360ca0bbd9402fea50f5e9e7c609744a774b386b31d2f5a0f9b89350f8" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="9beac6c0325f20f9e752e8ad587263ecf78579eb3df17c861a29a801c2b8d57c" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="0b4ffc86f5b8aee6a756190de435934200ea76683ed84e688b4afc3b4ab0a968" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="bb6ca85d9f16c872f6c8db552027dfe295f96b901ebe3529d73f63ef5af1e49a" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="7d73c329ef94778ce3f2e4e427d978e3a96985b4b859dcd104b6d8c8fc719b25" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="e43d1248b9054f8685ed11b415d27354e4024a23a0cac5ae4e05f615d7290dc5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="b400b7d64cc2155fbc45f8068a9ff42da13206be3e7e83fec07c06fc8bd28e85" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="7901fae5ccdbb361bd35610a861222e8213bf72fbab02ba73d33edd6b323c04d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="adeae89f214350bf6d93072d31c12383de239e1eb7f5e2f7e68550e9878f6af7" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="2c08c079a3b6c56dbe0af16034482bacf4a7020297a2ab1c449fe5feda1b82fa" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="214a0da621d83927d9042c1895f51f86558f8c7f107a9809da454edda58c3d89" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ccbda10e37ff2fd9332890dc62e2371079b3d9087e2b9cc8c2e32fd8f43af5cf" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4d99a02bef15f74485521266493733193e991776bd1fc315e2b2de832ffd05a3" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="ef77477cde6d333127494acfd785314c2a3e30de232b9483f551b33216fb2dc6" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a71cfa141c9490ad1a18d1488733096714760be6f79a364eabd540a6ba42eb7f" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="9c7462289b0e1a9bf65de9dfa95488864595a89ab6c45d5ae6ebe693096091c5" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="d2df225ece7cd5a39d7b17aa440bc0e5ca2e81a9ab8669321d01b7e14160aa20" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="f0c8566dcd94c932b120fe7cdb677fb4c3531f535e1c7fc41b49f8f8068a8695" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3622f05fed9d72143aed35d8f43cacbdc1a50b23baa474064f00eba48a79fae7" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="27d809cb2e87e1aff4593daae09ad185ba0f3d595eae685d71ce59355e655a7d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="133503f0aa9e0e3f2ed2b2e1e12eeafc9e5fd7f234eb2b043bfcd029f75a06bf" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="8469112342027edb325146db3161896f07a3e8effaefe67061c84b73d45708d7" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="4644504eb28a6c5c8de5f12660ff2cb132e8d0b97a34d10d338d84b5850d1968" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="93e1c3830100d4db11c00bf994629ff15ff484b9728aa45d178b51978d78e508" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="ca96cbd18b88cd2571e3d36cdbe7abeb59a80550e1f4316d4a55b51b57d1664f" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="dd52d46c6d3cfd476416df1aa5aa47c13be5cf60ffdee448d832ff3227cd4c50" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="313acde4dfe0743cd354d1e1eb3420846ccdd8a608cf9a86444764f74d6859bd" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="1521dfbb8654c1ad3927547a1e3ebf18ebda8736f05cf237a89dce46542a18c6" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="5a1044222cc67fe18519783bd795171a4ced7382149311a32d8171e2476e9db1" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="13b2afb6813bf22e89d5f93f653115287b6d0fd02ff81599d5125f63bb16b2b4" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="f91afd25dc53f0c69c0dcf1ff61e29652a99975c161b159589446551295bbd02" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="570eca1092259e90cc31487df8095fac4145cb4ed3f6eb92fb52752ca512bfa9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="11292ed78e64541cade9fbaec9aa58a51cc67543dbe89b1df7b9eddbd85572ea" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="6f4553b83137e3e9b68cebd399d3d8676b41b53bc319bd5fcb1bc553a5db415b" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="908f1b65c530386b1c76449ff89c2e520eedcdcfc1893d682a5ca42a41a7b0df" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="4db4520f46c087850b2fd9082cc830c1088dee26510f033f11fb214ad5417a09" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="e89dfb6fee5afe89ed7d8921f8b4aa3a2fcb9fbfc0cb554ce65ca4b3b26e4719" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="b87e881efa6b369aa6206f843e31f7f0c4e65ceb24928aa6940102387d932cb5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="718ed4c862cba2e61159d7ce07f607e4174e3c161f18ad2eab24f00d88860dd7" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="27ec78b0e8f0d08611cba6a4b355b8b3762b2d96dbd0edae0892f5c06e3c4ea0" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="8fab05ac20f99e22ab3ea3063800a730367d6bb5fa3700c6d5b992b6f18258ef" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="e4409be5a934e6c65614973cc67f6a87b7388a937508140c493aecc5ed97a8fa" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="e440f3c04680768dfe0a9c272d738725d94ad417ff819173956e17ed6c288aba" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="205f5e440d8bfdd8a909a8abfdb37606638fcde1020957fdfb2bcd3a5666e553" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="46c27ec40f1f989bb6336d35aa0771d934b0e1e71ce55272f7a7bbf54f648850" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="cedf80ca8980e7e3c42c588e2e4e06e4d4ff0d2db7e52f0a133f37e398f5546e" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="6bf4705d51ce3754cb7584e69d019e8dd066cd47b6876a13e2b5d1fe9f20ab05" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="dc9b7bd599dd6f2a659b85105d85cc194d01ffa9d8b52ff1431e54f2ade529b2" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="aa94961b7949858fe93c8c31c6f9ea60bad55bd515fe8e5fb2a71d52035fa5cf" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="e513113b27afc527105e109374ebda4f7648f6ce30e33f44e44c48c41b155fa9" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="811cdcfc97e2e00841488d4a1f0c3b53a7870bf934f2ea482c11d85f85972c4a" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="ddbdb4f69ec6a69d22d74c8457cb7e4579a5bacc457ee44588a108af33961960" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="884b94b2ed18c730d776ce5c1ce07288d9a87acc49a6c4582a6ff3781056b77d" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="8a32b6cd4b6346dcf725ae8d1a094eef74abdf43f8de7609ee3bb92c7a9a22f2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="410455ed2f22d520e132a09c5e0f65804672b4ba91db8c56f72dc37158a2ec81" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="3c2d5385fde8267598bfabbfd77c39c9839eb3b9cde31590ea27fedd3b896bbe" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="135596aeb4fc2f8ba38e4b3b088da3491f867bce10179a3f5101eb637800e33b" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="d8fb293e575a312d6ab96fcbca0cfc2c51dd12fe82bbb33c870adc29b98e787c" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="20a8cf32718ca23103e5f1c6c89465ff01ef430f36fe181ee0268ede5662aa60" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="45fd419bb9d252fc163c9ac1e5bb181bddb4faeec255125a803c185dc72ba28f" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="21c52ccf028c1c2ef5ebe87239f0bfb1b51110582d15b8633357946b2d78f651" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f4a640fd0acd0fbdfd627e6176a3274b8fbc584ef9a92db5020e61fa54e52530" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="3159158f038d2abbaa90b069b5620630a5fa7baff5b105c1572d3acbfc20b2bf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d0f4b7434ffbd84248b2f11e18ceac763cd8d8cc901e4d5bb6a974ac6d54fcc6" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="60daa90f906ee457ee3d2921a256401b34732e575e07a55cdcf82a6654f89934" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a51a1693b91e2faa114a147908440f69e0fb480968eaffec0a518c932760acc6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="142cdb4975184c9765a7bc9cc782d9610270c7c48808a1cbc3da0230eb51c6d5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9621a1ff7b1b5f4821d3749e121fc98efc6b988502d71f1f5f63d36d77c417c2" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="b53c073ebea7c065b88fba5fedac4a46c67126f58367350a15b3b595dd4719ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="15753b06659fc0e2705eabb37f6797d279c31e62d0b5936d99f2b5d3a8d70e50" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4638f9901ff553819e75fb62b2d761bd7ab91067356cabe0630079d6fb1f3e41" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="abbe1b40b59c89c1853c2808eb339537b6ade7b1f49b2bb374ea22e4945da315" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="83caf2e16a98cffc22a81c95caef2f7ada3f25628425124f9c160de5c83d3376" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="99986c7e90ceb72eb8f5dff86f9f94d814ceb4cb0370cb8972bd8f46c1333cad" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="efa7ab95cb93e8c13a7d5f2ac3e9c3c3bf600b5727e025707e391a71cfc6c352" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="ece72e8f4a78ab1dfd73cf6db3017e6f8f4117e6adfa9507229689cd4ccd23ac" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="f965d6248ff819194f3409b4f87491918894c24d73dbe8d75a1c2a014fe9f261" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="0ac7837f7ce5892d72f73798a24294003f2e116c7187b81a66f84475f9988a98" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.0" rel="150200.8.212.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
</package>
<package pkgid="c71479edacea0959c1199d24064a56a127d668446e616fd4db21590987dd27cc" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="95af7021a74ecf7e5e808ebd7fe121d5e31e489606fc9919f76d5efd52e6c8a0" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="59c2889b14aca27e0cb0a707bbb217a0c4d5cd87d6a314fb1bcbed6d58119eeb" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="0b28138e13d473799bb5978e10dacceed254ddf3e60a77932a70e1223ae4bf5a" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.1" rel="150200.8.215.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
</package>
<package pkgid="d8f3f3d3df6ea4b1e54e90867f899b1abbf60f3f24a77ba3086eb6a6c201db5a" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="0a85dae21d66543851d3cf7281128dda64c3fb034b7fa7405801713ea816bfec" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="2a7cadaa2fa973f2f9b1e9499e7e95ee43fd97fac6717b49d4600bbbfa886423" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="1ca71d72831a5a46cb896b40e060bafe23d53ad090ad6f715300c7d84ff1cdbf" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.10.2" rel="150200.8.218.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
</package>
<package pkgid="02f7d8fad9f4a11f7b56bf8a00e0b9f20ef9c11b07b63c8eaa04e8dcfd1563d7" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="2ecd5e9e7f6b421de719bda8bd0e88ee7d09236a564f42ed5fc61826c6faf178" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="19ef6482ff480ab1f42f878a6cd4bf1eaed90fe7f08902281756a3f2683679d7" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="e69850ac4e6cfeda6d463767a29448e3d3172730348688cbbaf97f2b098fc217" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.0" rel="150200.8.221.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
</package>
<package pkgid="7c68da04b782b5c15891f8b02df118323a3bd629a9a8ef4a53a7805a72cd76cf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="7fd58a3344a5d55dde9b1811530b9421a8d8dfd0f978c492d43e742243421b98" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="d0da3864efab925ecef0d73e7e57044dba9190e41a9736103b00da4916bd6ea4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="acfdaee1fa5f00f558ef303b142f641f43257467a451d038e6937c1e80604809" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.11.1" rel="150200.8.224.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
</package>
<package pkgid="43ddcaa478b0ba42abbe513d414987eaa1ecced72bef1a99e3148ebd138df90d" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="47b252760c0ddf48547b5d5643f5903ed0cfa3ffc90568e64144da4559ae1962" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="e8f13c277844694c1cc50cfb266c43ee48a5fb1132671252e31e501e3b36a3ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="fc2733d6d0360aa3d95b577056dc8a2129f9de9d93b110181b482d917c6dcabf" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.12.0" rel="150200.8.227.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1746014400">- Mozilla Thunderbird ESR 128.10
  * changed: Changed color override defaults with high contrast
    mode on macOS and Linux (bmo#1940220)
  * fixed: Using `Delete` column in "Search Messages..." window
    could delete other messages (bmo#1951680)
  * fixed: Security fixes
  MFSA 2025-29 (bsc#1241621)
  * CVE-2025-2817 (bmo#1917536)
    Privilege escalation in Thunderbird Updater
  * CVE-2025-4082 (bmo#1937097)
    WebGL shader attribute memory corruption in Thunderbird for
    macOS
  * CVE-2025-4083 (bmo#1958350)
    Process isolation bypass using "javascript:" URI links in
    cross-origin frames
  * CVE-2025-4084 (bmo#1949994, bmo#1956698, bmo#1960198)
    Potential local code execution in "copy as cURL" command
  * CVE-2025-4087 (bmo#1952465)
    Unsafe attribute access during XPath parsing
  * CVE-2025-4091 (bmo#1951161, bmo#1952105)
    Memory safety bugs fixed in Firefox 138, Thunderbird 138,
    Firefox ESR 128.10, and Thunderbird 128.10
  * CVE-2025-4093 (bmo#1894100)
    Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird
    128.10
- Update signing key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747310400">- Mozilla Thunderbird 128.10.1
  * fixed: Standalone message windows/tabs no longer responded
    after folder compaction (bmo#1960349)
  * fixed: Thunderbird could crash when importing Outlook
    messages (bmo#1851297)
  * fixed: Visual and UX improvements (bmo#1960861)
  * fixed: Security fixes
  MFSA 2025-34 (bsc#1243216)
  * CVE-2025-3875 (bmo#1950629)
    Sender Spoofing via Malformed From Header in Thunderbird
  * CVE-2025-3877 (bmo#1958580)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links
  * CVE-2025-3909 (bmo#1958376)
    JavaScript Execution via Spoofed PDF Attachment and file:///
    Link
  * CVE-2025-3932 (bmo#1960412)
    Tracking Links in Attachments Bypassed Remote Content
    Blocking</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1747828800">- Mozilla Thunderbird 128.10.2
  * fixed: Messages could not be viewed if the profile used a UNC
    path (bmo#1966256)
  * fixed: Visual and UX improvements (bmo#1964156)
  * fixed: Security fixes
  MFSA 2025-40 (bsc#1243303)
  * CVE-2025-4918 (bmo#1966612)
    Out-of-bounds access when resolving Promise objects
  * CVE-2025-4919 (bmo#1966614)
    Out-of-bounds access when optimizing linear sums</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1748865600">- Mozilla Thunderbird 128.11
  * fixed: Thunderbird could crash if message copying to Sent
    folder was interrupted (bmo#1965304)
  * fixed: Security fixes
  MFSA 2025-46 (bsc#1243353)
  * CVE-2025-5262 (bmo#1962421)
    Double-free in libvpx encoder
  * CVE-2025-5263 (bmo#1960745)
    Error handling for script execution was incorrectly isolated
    from web content
  * CVE-2025-5264 (bmo#1950001)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5265 (bmo#1962301)
    Potential local code execution in “Copy as cURL” command
  * CVE-2025-5266 (bmo#1965628)
    Script element events leaked cross-origin resource status
  * CVE-2025-5267 (bmo#1954137)
    Clickjacking vulnerability could have led to leaking saved
    payment card details
  * CVE-2025-5268 (bmo#1950136, bmo#1958121, bmo#1960499,
    bmo#1962634)
    Memory safety bugs fixed in Firefox 139, Thunderbird 139,
    Firefox ESR 128.11, and Thunderbird 128.11
  * CVE-2025-5269 (bmo#1924108)
    Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird
    128.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1749643200">- Mozilla Thunderbird 128.11.1
  * fixed: Security fixes
  MFSA 2025-49 (bsc#1244468)
  * CVE-2025-5986 (bmo#1958580, bmo#1968012)
    Unsolicited File Download, Disk Space Exhaustion, and
    Credential Leakage via mailbox:/// Links</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1752062400">- Mozilla Thunderbird 128.12
  * fixed: Security fixes
  MFSA 2025-55 (bsc#1244670)
  * CVE-2025-6424 (bmo#1966423)
    Use-after-free in FontFaceSet
  * CVE-2025-6425 (bmo#1717672)
    The WebCompat WebExtension shipped exposed a persistent UUID
  * CVE-2025-6426 (bmo#1964385)
    No warning when opening executable terminal files on macOS
  * CVE-2025-6429 (bmo#1970658)
    Incorrect parsing of URLs could have allowed embedding of
    youtube.com
  * CVE-2025-6430 (bmo#1971140)
    Content-Disposition header ignored when a file is included in
    an embed or object tag</changelog>
</package>
<package pkgid="066f8e26b643b1de8518e3ced43475408ef88f9e248d0da89cd38b3b8d5a3f13" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="50ade53510e6f20c9de1da26e085fca095b8fd5702f7b28d10f707158e4250cd" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="f2b6a645fc295225ff971b0671f00db72c25ec58bcb58b92c6f65df9db4f216d" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="649393bf08c76b08d4c3cc331c66755ef458ed5b57dc774f61aec86a90639e16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.3" rel="150200.8.177.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7ba8860ad13f6319855bdda02c36e6c51a83fc24fd6e5369dd551212e465d19c" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="b2f04beb617b202dbba04074249d3415f5861ad9b61ae9e4094d80ea4587f901" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="ad20095c1461103cd063277d0748d4edac8ef51660727d01910ff2d015b5bd7a" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="3fb4958522bc82579d77e0215d862d5282ae3316d565068e8b80ff4c31cc707a" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.0" rel="150200.8.182.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
</package>
<package pkgid="5c2eb89e797661e3d4e2b28cb7f41db8b573f74969e135f1782f56e7ae3a0ae1" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="ecedee9caae6a5d61e4e42048181e1c33e8f83a618d2067312dd79b5741a7bac" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="149b0ed73a935cdf917976e7f4e150a33b26262199d223c108dbcd7bfead0fa3" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="0b1d900fdfa2ed1e843fb01cb6ba0372b6f64e792b42af325c5829e2268add68" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.3.1" rel="150200.8.185.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
</package>
<package pkgid="72315177033c0c635be40c5b9df1e6c1f5f57ecaa993feffbbe0b34fad407969" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="f4c07f7be7b3234dd1852bf56321241b08c03ca85f7e5d711cba55354b8f1115" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="38c11d5c19ecf6b711f2a11a2a1bf920408aa909096761dbc2c94e88540b4c42" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="32f3fef0dca2bba05cec09ac5e7ac9527dc2005160eb0aea65e3bf494b365726" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.4.3" rel="150200.8.188.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
</package>
<package pkgid="4c7d22f5edeed3b6a509c4934e2351f98927173fda7627374832ca4ec8eb05b7" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="640cd434233054502393dae349609b0527abf00f47bdbf90ea3e2b7a782acc0c" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="ef9cb766a4625e3527918bf6fc9dcfee691f4ed5a064fcfc58dab4aa3718ffea" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="d4e9440848c8a969d6634dafb350f1d8c233dfd6e63a6bac4918df75bb897d16" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.0" rel="150200.8.191.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
</package>
<package pkgid="4b030a5d6980ba2bf86e06fc75859a60a9893be48ea9cd969f6b8e0f0e115fad" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="d0568340928240fef88f8cdcfc5cc3c70931cb401efbee8d649952405a866f04" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="756b6a58d75bf228e8f097b8039c4bb4092d9b964df755a12d163e720c72e3fa" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="0d809d5d8467795e6e228977e057fb5e687b282aaf2dded5520114ec5935c296" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.5.2" rel="150200.8.194.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
</package>
<package pkgid="4b5da377b4dd0a62fdd769c850f1eb9f8b7f2a7aee0413be8a876969469d43b5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="7e5c56da2dbd3cb38183953891fcca90abb08a6c3ee42eef37dc5156b4450035" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="afa8dd80f12d5052299c3c560c67599578efadf8ab2ba4f621c900bc53bac9c0" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="4a9405291d7497544cb759c073cad503d6540240b2f326ad96ec86254d84d2f1" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.6.0" rel="150200.8.197.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
</package>
<package pkgid="97cb06e6f566cbec4f7d3526dd77fd35c400cbe609fc043ce494f2d67d62de64" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="a5ccfd8cbb0c91f4759628f6dc13029dc076e39839b572902a802861dd7cac30" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="bb11e0add6639ede07f0f82098a62e60d4ea73aba7610fa59c1d78c56f7a33f4" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="a86d288f70160b3e0f23d12dbac98c18c5248696e4a8fd29b81a37fa14610f5d" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.7.0" rel="150200.8.200.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
</package>
<package pkgid="be99b235b2cc0ba45c38b3d7edf209895db83d3e3df239725e8ab9dba0cd6e99" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="d403268bcc813c47fce98e91feb4f851f852971d99fa1429b3a30bedd1c9f1eb" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="0ec86b17eedf1c384e465e3c22b2beeb4923543f8a95c797db396d83a1a4487c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="ecea00debc51bf87db87ebf1a392ce5ed23ae56cc64fcb69855f98eb04483ce4" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.8.0" rel="150200.8.203.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
</package>
<package pkgid="95f8c41827814dea08c678e92f58ff5366e0dc7fb9d3d4d0e7d6f75f55675c39" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="37da1ebe672fbf27799656f0a40db6e603071737bf380b5975ff884e8cb95094" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="832cf39f76a1dc024cb698e23b17c27cad2736547665da23943dd7feb10618d6" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="7c4cd48f334ba203dcb6bc8d1cae0050fd79bbab02d01e5c42995a6e151fac96" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.0" rel="150200.8.206.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
</package>
<package pkgid="c6d709e37cd3b396cd53eb1ec6432e9fbce4587c4049fbdf6041bb35e13f95ba" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="b3331e8358f967503b753610f4dd16483ef9a3aa522ff99197a0209fe610c7fa" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="bf8dacd1bdc6ffa69b3db55892c7d2943e332bb1667af70f65be3a0b3a32d410" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="216215d2fc4a06f79e5d04b064978b5c688e6af5f926be68d4118d512e2830af" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="128.9.2" rel="150200.8.209.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724155200">- Mozilla Thunderbird 128.1
  * fixed: Could not add override for a certificate with the
    wrong hostname (bmo#1903135)
  * fixed: Auto-detection of CalDAV calendars and CardDAV address
    books failed in certain scenarios (bmo#1583053)
  * fixed: Potential memory leak in local folder repair
    (bmo#1906835)
  * fixed: Selecting messages and then switching to a new folder
    with no selected messages did not clear selected messages
    count (bmo#1905542)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: UTF-8 encoded messages became garbled when encrypted
    using inline OpenPGP (bmo#1899110)
  * fixed: Could not access the contents of an S/MIME encrypted
    message wrapped in a digital signature (bmo#1806161)
  * fixed: Occasional crash occurred shortly after startup
    (bmo#1872230)
  * fixed: Flatpak created a duplicate unpinned icon in Linux
    dock after launching Thunderbird (bmo#1904390)
  * fixed: Flatpak release notes URL was incorrect (bmo#1907397)
  * fixed: Spell checker dictionary was not available for Flatpak
    install (bmo#1908046)
  * fixed: Digital signatures on signed-only OpenPGP messages
    were broken with some providers (bmo#1908113)
  * fixed: Visual and UX improvements
    (bmo#1875054,bmo#1906497,bmo#1906758,bmo#1907761)
  * fixed: Security fixes
  MFSA 2024-37 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
- Mozilla Thunderbird 128.0.1
  * fixed: Opening profile import tab then restarting Thunderbird
    caused import tab to malfunction (bmo#1905708)
  * fixed: "Total" column did not display message count when
    using "Grouped by" sorting (bmo#1901439)
  * fixed: Could not add events to CalDAV calendar when UID
    contained special characters (bmo#1716745)
  * fixed: Visual and UX improvements
    (bmo#1906432,bmo#1906499,bmo#1906498)
- Mozilla Thunderbird 128
  * new: UI density now affects multi-message view (bmo#1868863)
  * new: Added new preference `mail.addressDisplayFormat` to
    always display full name and email address of all recipients
    in message list (bmo#243258)
  * new: "Archived-At" message header field is now displayed as a
    link, and Message Permalink option is now available in List-
    Id menu (bmo#512385)
  * new: Threaded message views now include "New Message" count
    (bmo#1883506)
  * new: Cards View hover and selection paradigms introduced to
    better support custom themes and accent colors
    (bmo#1857120,bmo#1863614)
  * new: Added account context menu to Unified Toolbar "Get
    Messages" button, creating quick access option to retrieve
    new messages for individual accounts (bmo#1837152)
  * new: OpenPGP no longer attempts to re-initialize secret key
    storage if individual OpenPGP secret key passphrases have
    been enabled (bmo#1842629)
  * new: OpenPGP Key Manager can now create revocation statements
    for any secret key (bmo#1852565)
  * new: A nested OpenPGP message's signature status is now
    viewable (bmo#1861703)
  * new: Changing expiration of OpenPGP keys with a "complex"
    structure is now supported (bmo#1666507)
  * new: Enabled ECDH encryption and decryption for S/MIME
    messages (bmo#1892223)
  * new: Custom account colors are now shown in the "From" field
    when composing a message (bmo#355520)
  * new: Manual account configuration now implements form
    validation (bmo#1863264)
  * new: iCloud contacts and calendar discovery now supported
    when using a dedicated app password (bmo#1854779)
  * new: Improved layout of LDAP address book properties dialog
    (bmo#1895826)
  * new: Thunderbird now uses native Windows notifications
    (bmo#1192615)
  * new: Added support for OS-specific accent colors
    (bmo#1869893)
  * new: Added system accent color support for various elements
    (bmo#1890993,bmo#1891289)
  * new: Selection indicator added to folder pane and address
    book pane (bmo#1899842)
  * new: Thunderbird now decodes messages nested in attachments
    even if `decodeSubMessages` preference is set to "false"
    (bmo#1881560)
  * changed: Improved Cards View readability and accessibility
    (bmo#1855821,bmo#1856623,bmo#1858578,bmo#1882369,bmo#1864064,
    bmo#1877324,bmo#1860867,bmo#1877324,bmo#1860141)
  * changed: Better threading and unread/new indicators for Cards
    View threaded messages (bmo#1860868,bmo#1855823,bmo#1855824,
    bmo#1870376,bmo#1867078,bmo#1865433,bmo#1860599)
  * changed: Removed Account Provisioner (bmo#1893331)
  * changed: Search bars in Thunderbird now use a common custom
    element for more consistency (bmo#1898130)
  * changed: Updated donation link from "give.thunderbird.net" to
    "www.thunderbird.net/donate/" (bmo#1820676)
  * changed: Activity Manager now shows account and full folder
    path when indexing (bmo#1823024)
  * changed: Spam and Junk message styling in Card UI adjusted to
    be less distracting (bmo#1880163)
  * changed: Removed `mail.openpgp.key_assistant.enable`
    preference (bmo#1868214)
  * changed: Disabled support for LibrePGP v5 AEAD/OCB decryption
    (bmo#1872833)
  * changed: "Permissive" importing of problematic OpenPGP keys
    now disabled by default; Set
    `mail.openpgp.allow_permissive_import` to allow (bmo#1829881)
  * changed: A warning is now displayed when importing OpenPGP
    keys that advertise unsupported features (bmo#1874715)
  * changed: Default sort order of messages in message list
    changed to descending (newest at top) (bmo#481143)
  * changed: Added Show more/less buttons to notifications in
    Account Hub (bmo#1863265)
  * changed: Removed "Becky! Internet Mail" importer
    (bmo#1810915)
  * changed: The "prefer display name" preference for individual
    contacts was removed in favor of the global preference
    (bmo#1894048)
  * changed: Address book updated to new card design
    (bmo#1847427,bmo#1894280,bmo#1898851)
  * changed: Addressbook toolbar updated with the same UI/UX
    paradigms of the folder pane (bmo#1899666)
  * changed: Folder alerts now display full path of affected
    folder (bmo#988792)
  * changed: IMAP "Too Many Connections" alerts now display IMAP
    server name (bmo#561055)
  * changed: Date range intervals in "Find Events" panel updated
    (bmo#1844408)
  * changed: Calendar ICS file import now always uses new
    importer (bmo#1896844)
  * fixed: Thunderbird "--migration" flag opened empty window
    (bmo#1867860)
  * fixed: "Confirm Deletion" prompt was incorrectly shown when
    deleting messages with Grouped By header also selected
    (bmo#1873313)
  * fixed: Thunderbird did not remove temporary directory created
    from adding attachment to message via drag-and-drop
    (bmo#1873950)
  * fixed: Certificate errors silently failed when fetching new
    messages (bmo#1893899)
  * fixed: Clicking on native Windows notifications did not bring
    Thunderbird to the foreground (bmo#1863798)
  * fixed: 3-pane view was blank after starting Thunderbird with
    unsent messages in outbox (bmo#1865806)
  * fixed: Some menu bar items did not work with all Thunderbird
    windows closed on macOS (bmo#1868718)
  * fixed: Sender in multi-message view was right aligned when
    the text wrapped to multiple lines (bmo#1880252)
  * fixed: "Find in this message" did not work in multi-message
    view (bmo#1839005)
  * fixed: Non-compliant "References" headers were not handled
    gracefully when `mailnews.headers.showReferences` was set
    (bmo#1888116)
  * fixed: "news://" URIs failed opening as links or from the
    commandline (bmo#1886132)
  * fixed: Thunderbird sometimes displayed a blank screen on
    startup (bmo#1869685)
  * fixed: Standalone window titles no longer included message
    subject on macOS (bmo#1847622)
  * fixed: Links with IP address as link text and destination
    incorrectly warned user that link text and destination did
    not match (bmo#1804628)
  * fixed: "Open message in conversation" and "Open message in
    containing folder" from a standalone window failed
    (bmo#531319,bmo#1851975,bmo#1877962)
  * fixed: "Get Messages" toolbar button was initially disabled
    after opening a message from a file in a new window
    (bmo#1876662)
  * fixed: "Open Browser With Message-ID" failed for Google
    Groups due to URL change (bmo#1887334)
  * fixed: Focus behavior for opening messages in a new tab
    changed depending on state of `mail.tabs.loadInBackground`
    preference (bmo#1894831)
  * fixed: Focus changes in 3-pane view occassionally caused
    keyboard shortcuts to stop working (bmo#1853442)
  * fixed: Selected row in folder pane did not always remain
    visible when using keyboard navigation (bmo#1868094)
  * fixed: Using middle-mouse click on a message (open in
    background tab) did not work (bmo#1853923)
  * fixed: Group-by-sort Unified folders were slow to open when
    expanded-all (bmo#1875577)
  * fixed: Holding Shift key while selecting "Delete" from
    message context menu did not permanently delete message
    (bmo#956446)
  * fixed: Holding Shift and middle-clicking a message with
    `loadInBackground` preference set to "false" did not open new
    tab in background as expected (bmo#1876883)
  * fixed: "Watch Thread" command was incorrectly available on
    multi-folder and search views (bmo#1368011)
  * fixed: "Ignore Thread" did not work on multi-folder and
    search views (bmo#1861200)
  * fixed: Date column of "Grouped By" message views now
    refreshes at midnight, preventing incorrect dates from being
    displayed (bmo#1520435)
  * fixed: Deleting a mail folder failed silently when disk space
    was low (bmo#1886360)
  * fixed: Undoing deletion of an email from standalone window
    was not possible (bmo#1855643)
  * fixed: Sort type in Quick Filtered and Grouped By unified
    folders was not preserved after search was modified or
    cleared (bmo#1894896)
  * fixed: Unified Folders did not preserve sort setting when
    switching to unthreaded view (bmo#1893793)
  * fixed: Thunderbird did not always display message deletion
    confirmation when using Shift+Delete keyboard shortcut
    (bmo#958088)
  * fixed: Deleting collapsed group in Grouped By Sort did not
    update the message list to reflect the change (bmo#1878047)
  * fixed: Secondary sort was discarded when sorting threaded
    unified folders (bmo#1897781)
  * fixed: Accidental deletion of multiple messages occurred when
    &lt;kbd&gt;Delete&lt;/kbd&gt; was pressed and held (bmo#1675212)
  * fixed: Message count for synthetic folder views was sometimes
    incorrect (bmo#1896899)
  * fixed: Count of messages in a thread was not refreshed when a
    message was deleted externally (bmo#1893180)
  * fixed: Tag folders with non-alphanumeric characters did not
    work correctly (bmo#1901926)
  * fixed: Scrolling to an unread message in an expanded thread
    did not show as much of the thread as possible (bmo#1900916)
  * fixed: In a synthetic view, right-clicking an unselected
    message incorrectly selected the message (bmo#1902549)
  * fixed: Messages could not be sorted by columns that were not
    visible (bmo#1830262)
  * fixed: Display columns reverted to default columns after an
    IMAP folder was repaired (bmo#550286)
  * fixed: Mark as "Read By Date" was not available when a folder
    with unread messages was selected (bmo#1904191)
  * fixed: Dynamic height calculation for Cards View based on
    density and font-size (bmo#1865616)
  * fixed: Message List display options were hidden outside of
    Thunderbird window (bmo#1854393)
  * fixed: Compact icon on Unified Toolbar was updated with a
    compact folder icon (bmo#1846323)
  * fixed: Improved localization of OpenPGP strings (bmo#1831909)
  * fixed: Creating a new key from the OpenPGP Key Manager
    erroneously displayed a "Go Back" button on the first page of
    the wizard (bmo#1788962)
  * fixed: Some OpenPGP dialogs' buttons were inaccessible off
    screen (bmo#1733086)
  * fixed: OpenPGP decoding of Base64 data did not allow for
    spaces and tabs before footer (bmo#1883855)
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Parsing an email address with a comment caused a
    failure for OpenPGP (bmo#1905014)
  * fixed: S/MIME messages did not display MIME message if MIME
    header was missing (bmo#1893039)
  * fixed: S/MIME status (encryption and signature) was not shown
    when opening an email from a file (bmo#1902991)
  * fixed: Add tooltip displaying full folder path when hovering
    over location column of thread pane (bmo#522768)
  * fixed: Clear button was missing from Unified Toolbar
    customization search bar (bmo#1891498)
  * fixed: Global search sometimes loaded slowly when opening
    "Show results as lists" and other synthetic views
    (bmo#1896913)
  * fixed: References and Reply-To headers were not set if they
    were included in `mail.compose.other.header` (bmo#1800759)
  * fixed: Message compose window was not fully disabled while
    message was sending (bmo#1758469)
  * fixed: Delivery Status Notification did not work when sending
    message using "Send Later" (bmo#815638)
  * fixed: Print dialog opened in Message compose window did not
    prevent window interaction (bmo#1758470)
  * fixed: Source of 'news:' links were incorrectly attached to
    messages by default (bmo#1787143)
  * fixed: Password Manager did not remember the last selected
    item when changing sorting or showing/hiding passwords in
    unfiltered view (bmo#1301248)
  * fixed: Entries removed from Password Manager left behind
    blank entries (bmo#1884661)
  * fixed: Messages moved to junk folder from message context
    menu were marked as read, regardless of whether "Mark
    messages determined to be junk as read" was checked/unchecked
    in settings (bmo#1860444)
  * fixed: New posts retrieved from RSS feeds incorrectly played
    mail alert sound (bmo#1871493)
  * fixed: No "Close" button in Cookie Manager on macOS
    (bmo#1042344)
  * fixed: Pressing &lt;kbd style="border-radius:4px;padding:1px 2px
    0;border:1px solid black;"&gt;Esc&lt;/kbd&gt; did not close the Cookie
    Manager dialog (bmo#1891311)
  * fixed: Modifying Thunderbird UI font size outside of
    Thunderbird caused App Menu &gt; Font Size option to be disabled
    (bmo#1872490)
  * fixed: Chat Account Settings did not allow scrolling to view
    overflowed window contents (bmo#1868796)
  * fixed: Account setup triggered a second OAuth when looking
    for calendars (bmo#1880646)
  * fixed: Google Calendar account detection failed for Google-
    hosted domains when the DNS entry had uppercase characters
    (bmo#1864203)
  * fixed: Thunderbird did not have a preference to enable
    archiving inbox as a folder (bmo#697706)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: Querying DNS TXT records that return multiple records
    failed (bmo#1571076)
  * fixed: Yahoo! and AOL account message filters only filtered
    most recent message match (bmo#1865598)
  * fixed: "Copy/Cut" context menus did not work in extension
    options pages (bmo#1678057)
  * fixed: Adding duplicate mail addresses in "New/Edit mailing
    list" dialog, pressing OK, then removing one of the duplicate
    addresses caused both addresses to be removed (bmo#1799368)
  * fixed: Address Book scrolling did not work when using
    keyboard navigation (bmo#1870873)
  * fixed: CardDAV addressbooks could not be used as an import
    target (bmo#1893876)
  * fixed: Removing Organizational Properties from a contact did
    not clear all organization-related fields (bmo#1901739)
  * fixed: CardDAV contacts were synced to server when no changes
    were made (bmo#1898136)
  * fixed: Compose window toolbar items were unreadable on macOS
    in dark mode (bmo#1893249)
  * fixed: Dark mode colors were inconsistent throughout
    Thunderbird (bmo#1819232)
  * fixed: NVDA keyboard table navigation of message list did not
    work in table view (bmo#1843486)
  * fixed: IMAP folders containing other folders could not be
    deleted due to Thunderbird using "unsubscribe" IMAP command
    (bmo#1856536)
  * fixed: Draft messages were not replaced when saved to an IMAP
    server without UIDPLUS support (bmo#1882013)
  * fixed: Connection sometimes timed out when a large number of
    POP3 messages were left on server (bmo#1875633)
  * fixed: SMTP messages using GSSAPI authentication failed to
    send (bmo#1883529)
  * fixed: Status of IMAP message download progress was incorrect
    in some locales (bmo#1880043)
  * fixed: Newsgroup messages were sometimes incorrectly
    interleaved when using offline cache (bmo#1857450)
  * fixed: Thunderbird sometimes froze when checking for new
    messages on multiple POP3 accounts simultaneously
    (bmo#1847137)
  * fixed: POP3 tried using USERPASS first (plaintext
    credentials), before attempting AUTH PLAIN and AUTH LOGIN
    (obfuscated credentials) (bmo#1897045)
  * fixed: POP3 server connection sometimes timed out when
    processing LIST and UIDL responses (bmo#1893307)
  * fixed: Restart was necessary to read an NNTP message if a
    network error occured during message retrieval (bmo#1876261)
  * fixed: Account manager and about:support could break if the
    chat buddy list became corrupted (bmo#1902611)
  * fixed: IRC SASL authentication was enabled by default for all
    IRC servers (bmo#1618061)
  * fixed: IMAP accounts with missing or incorrect OAuth
    credentials sometimes caused duplicate dialogs to appear,
    requesting a new OAuth token (bmo#1880211)
  * fixed: Hardware key multi-factor authentication did not work
    in Thunderbird Flatpak (bmo#1882985)
  * fixed: Thunderbird defaulted to insecure connection when
    Exchange Autodiscover configuration was misconfigured
    (bmo#1900178)
  * fixed: Thunderbird incorrectly rejected some valid RSS feeds
    (bmo#1900280)
  * fixed: macOS performance improvements (bmo#1877142)
  * fixed: Updating times of recurring events also modified the
    event exception times (bmo#1890975)
  * fixed: Calendar 'Find Events Pane' did not match search terms
    if they included uppercase letters (bmo#1898856)
  * fixed: Calendar day headings did not switch between short and
    long form when resizing calendar view (bmo#1891739)
  * fixed: Task categories menu did not display category colors
    (bmo#1892673)
  * fixed: Today Pane was not Keyboard accessible (bmo#1898199)
  * fixed: "Item changed on server" calendar dialog did not have
    a scrollbar for long content, causing action buttons to be
    off screen (bmo#1889383)
  * fixed: Accepting/declining appointments did not always send
    confirmation (bmo#1878944)
  * fixed: Convert To &gt; Event did not save events on some CalDAV
    servers (bmo#1738611)
  * fixed: Context menu cleanup (bmo#1890374,bmo#1890375)
  * fixed: Various Cards View UX improvements (bmo#1855821,
    bmo#1855823,bmo#1856623,bmo#1859036,bmo#1855824,bmo#1857120,
    bmo#1858302,bmo#1858578,bmo#1860141,bmo#1860148,bmo#1860599,
    bmo#1864064,bmo#1865433,bmo#1860867,bmo#1863614,bmo#1865616,
    bmo#1867078,bmo#1882592,bmo#1890691,bmo#1863403)
  * fixed: Various visual and UX improvements (bmo#1855611,
    bmo#1870705,bmo#1871001,bmo#1872873,bmo#1869167,bmo#1892849,
    bmo#1893114,bmo#1893148,bmo#1894903,bmo#1895118,bmo#1895119,
    bmo#1895172,bmo#1904365,bmo#1903741,bmo#1891203,bmo#1902817,
    bmo#1902818,bmo#1903093,bmo#1903742,bmo#1904072,bmo#1904316,
    bmo#1892560,bmo#1845204,bmo#1849315,bmo#1865615,bmo#1888750,
    bmo#1889519,bmo#1890044,bmo#1890129,bmo#1890345,bmo#1880835,
    bmo#1894806,bmo#1899235,bmo#1901145,bmo#1901147,bmo#1878414,
    bmo#1891365,bmo#1901547,bmo#1846095,bmo#1861204,bmo#1892560,
    bmo#1281299)
  * fixed: Security fixes
  MFSA 2024-32 (bsc#1226316)
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128 and Thunderbird 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes
- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1725019200">- Mozilla Thunderbird 128.1.1
  * fixed: Compaction of folders greater than 4GB were truncated
    to 4GB on 32-bit installations of Thunderbird 128esr
    (bmo#1911076)
  * fixed: Some UTF-8 characters were corrupted when using
    OpenPGP signing with OpenPGP encryption (bmo#1911227)
  * fixed: Visual and UX improvements
    (bmo#1846509,bmo#1911219,bmo#1911629)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1727265600">- Mozilla Thunderbird 128.2.3
  * fixed: Reverted OAuth2 changes from 128.2.2esr due to
    authentication timeout after upgrade (bmo#1919695)
- Mozilla Thunderbird 128.2.2
  * new: Account setup is updated to support OAuth2 granular
    permissions (bmo#1909789)
  * fixed: Thunderbird could crash when using return receipt with
    OWL add-on (bmo#1917218)
  * fixed: Folder pane display was blank due to invalid mail
    server hostname (bmo#1911951)
  * fixed: Some users were unable to log in to Microsoft 365
    (bmo#1908866)
  * fixed: Matrix end-to-end encryption tab in account settings
    could be shown for XMPP account (bmo#1915199)
  * fixed: Participant and message were not populated when user
    left the room using XMPP (bmo#1914633)
  * fixed: Visual and UX improvements
    (bmo#1910474,bmo#1913329,bmo#1913741,bmo#1915826,bmo#1916089)
- Mozilla Thunderbird 128.2.1
  * fixed: Message window froze after clicking 'mailto:' link
    containing child elements (bmo#1914250)
  * fixed: "Grouped By Sort" state was not preserved for unified
    and virtual folders (bmo#1905912)
  * fixed: Repairing local folders caused messages in folder to
    temporarily disappear (bmo#1910168)
  * fixed: Repairing an IMAP folder resulted in incorrect total
    and unread message counts (bmo#1913224)
  * fixed: Quick Filter reset sort type in threaded views sorted
    by "Order Received" ascending (bmo#1774455)
  * fixed: Display names for SMTP servers could be incorrectly
    formatted as a date (bmo#1902742)
  * fixed: Importing profiles from SeaMonkey did not work in
    certain circumstances (bmo#1825995)
  * fixed: Calendar events filter no longer allowed searching
    past or all events (bmo#1855900)
  * fixed: Calendar updates were not added to cache when
    Thunderbird was offline (bmo#1908530)
  * fixed: Visual and UX improvements (bmo#1691301,bmo#1911603,bm
    o#1911775,bmo#1912655,bmo#1913251,bmo#1913889,bmo#1914751)
- Mozilla Thunderbird 128.2
  * fixed: Performance could be degraded when sorting with Quick
    Filter or Grouped By Sort (bmo#1908761)
  * fixed: "Mark All Read" on Quick Filter results marked all
    emails in folder as read (bmo#1894214)
  * fixed: "latest" download bouncer aliases were not available
    for 128 releases prior to 128.2.0esr (bmo#1907317)
  * fixed: Security fixes
  MFSA 2024-43 (bsc#1229821)
  * CVE-2024-8394 (bmo#1895737)
    Crash when aborting verification of OTR chat
  * CVE-2024-8385 (bmo#1911909)
    WASM type confusion involving ArrayTypes
  * CVE-2024-8381 (bmo#1912715)
    Type confusion when looking up a property name in a "with"
    block
  * CVE-2024-8382 (bmo#1906744)
    Internal event interfaces were exposed to web content when
    browser EventHandler listener callbacks ran
  * CVE-2024-8384 (bmo#1911288)
    Garbage collection could mis-color cross-compartment objects
    in OOM conditions
  * CVE-2024-8386 (bmo#1907032, bmo#1909163, bmo#1909529)
    SelectElements could be shown over another site if popups are
    allowed
  * CVE-2024-8387 (bmo#1857607, bmo#1911858, bmo#1914009)
    Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2,
    and Thunderbird 128.2
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728302400">- Mozilla Thunderbird 128.3
  * fixed: Opening an EML file with a 'mailto:' link did not work
    (bmo#1914887)
  * fixed: Collapsed POP3 account folder was expanded after
    emptying trash on exit (bmo#1897412)
  * fixed: "Mark Folder Read" on a cross-folder search marked all
    underlying folders read (bmo#1909617)
  * fixed: Unable to open/view attached OpenPGP encrypted
    messages (bmo#1837247)
  * fixed: Unable to "Decrypt and Open" an attached OpenPGP key
    file (bmo#1917577)
  * fixed: Subject could disappear when replying to a message
    saved in an EML file (bmo#1910477)
  * fixed: OAuth2 authentication method was not available when
    adding SMTP server (bmo#1917472)
  * fixed: Unable to subscribe to .ics calendars in some
    situations (bmo#1906077)
  * fixed: Visual and UX improvements (bmo#1917787,bmo#1912733)
  * fixed: Security fixes
  MFSA 2024-49 (bsc#1230979)
  * CVE-2024-9392 (bmo#1899154, bmo#1905843)
    Compromised content process can bypass site isolation
  * CVE-2024-9393 (bmo#1918301)
    Cross-origin access to PDF contents through multipart
    responses
  * CVE-2024-9394 (bmo#1918874)
    Cross-origin access to JSON contents through multipart
    responses
  * CVE-2024-8900 (bmo#1872841)
    Clipboard write permission bypass
  * CVE-2024-9396 (bmo#1912471)
    Potential memory corruption may occur when cloning certain
    objects
  * CVE-2024-9397 (bmo#1916659)
    Potential directory upload bypass via clickjacking
  * CVE-2024-9398 (bmo#1881037)
    External protocol handlers could be enumerated via popups
  * CVE-2024-9399 (bmo#1907726)
    Specially crafted WebTransport requests could lead to denial
    of service
  * CVE-2024-9400 (bmo#1915249)
    Potential memory corruption during JIT compilation
  * CVE-2024-9401 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16,
    Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
  * CVE-2024-9402 (bmo#1872744, bmo#1897792, bmo#1911317,
    bmo#1913445, bmo#1914106, bmo#1914475, bmo#1914963,
    bmo#1915008, bmo#1916476)
    Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3,
    Thunderbird 131, and Thunderbird 128.3</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728475200">- Add patch mozilla-bmo1923344.patch to fix bsc#1231413</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1728648000">- Mozilla Thunderbird 128.3.1
  * fixed: Security fixes
  MFSA 2024-52 (bsc#1231413)
  * CVE-2024-9680 (bmo#1923344)
    Use-after-free in Animation timeline
- Remove upstreamed patch mozilla-bmo1923344.patch
- Delete empty, unused mime-directory</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1731585600">- Mozilla Thunderbird 128.4.3
  * fixed: Folder corruption could cause Thunderbird to freeze
    and become unusable (bmo#1924291)
  * fixed: Message corruption could be propagated when reading
    mbox (bmo#1926810)
  * fixed: Folder compaction was not abandoned on shutdown
    (bmo#1924918)
  * fixed: Folder compaction did not clean up on failure
    (bmo#1923526)
  * fixed: Collapsed NNTP thread incorrectly indicated there were
    unread messages (bmo#520582)
  * fixed: Navigating to next unread message did not wait for all
    messages to be loaded (bmo#1842419)
  * fixed: Applying column view to folder and children could
    break if folder error occurred (bmo#1872595)
  * fixed: Remote content notifications were broken with
    encrypted messages (bmo#1924058)
  * fixed: Updating criteria of a saved search resulted in poor
    search performance (bmo#1923585)
  * fixed: Drop-downs may not work in some places (bmo#1928252)
  * fixed: Security fixes
  MFSA 2024-61 (bsc#1233355)
  * CVE-2024-11159 (bmo#1925929)
    Potential disclosure of plaintext in OpenPGP encrypted
    message
- Mozilla Thunderbird 128.4.2
  * changed: Increased the auto-compaction threshold to reduce
    frequency of compaction (bmo#1927656)
  * fixed: New profile creation caused console errors
    (bmo#1912675)
  * fixed: Repair folder could result in older messages showing
    wrong date and time (bmo#1911916)
  * fixed: Recently deleted messages could become undeleted if
    message compaction failed (bmo#1924927)
  * fixed: Visual and UX improvements
    (bmo#1857413,bmo#1922934,bmo#1924437)
  * fixed: Clicking on an HTML button could cause Thunderbird to
    freeze (bmo#1879355)
  * fixed: Messages could not be selected for dragging
    (bmo#1887518)
  * fixed: Could not open attached file in a MIME encrypted
    message (bmo#1924637)
  * fixed: Account creation "Setup Documentation" link was broken
    (bmo#1925493)
  * fixed: Unable to generate QR codes when exporting to mobile
    in some cases (bmo#1928114)
  * fixed: Operating system reauthentication was missing when
    exporting QR codes for mobile (bmo#1928232)
  * fixed: Could not drag all-day events from one day to another
    in week view (bmo#1922944)
- Mozilla Thunderbird 128.4.1
  * new: Add the 20 year donation appeal (bmo#192538)
- Mozilla Thunderbird 128.4
  * new: Export Thunderbird account settings to Thunderbird
    Mobile via QRCode (bmo#1926036)
  * fixed: Unable to send an unencrypted response to an OpenPGP
    encrypted message (bmo#1911080)
  * fixed: Thunderbird update did not update language pack
    version until another restart (bmo#1911887)
  * fixed: Security fixes
  MFSA 2024-58 (bsc#1231879)
  * CVE-2024-10458 (bmo#1921733)
    Permission leak via embed or object elements
  * CVE-2024-10459 (bmo#1919087)
    Use-after-free in layout with accessibility
  * CVE-2024-10460 (bmo#1912537)
    Confusing display of origin for external protocol handler
    prompt
  * CVE-2024-10461 (bmo#1914521)
    XSS due to Content-Disposition being ignored in
    multipart/x-mixed-replace response
  * CVE-2024-10462 (bmo#1920423)
    Origin of permission prompt could be spoofed by long URL
  * CVE-2024-10463 (bmo#1920800)
    Cross origin video frame leak
  * CVE-2024-10464 (bmo#1913000)
    History interface could have been used to cause a Denial of
    Service condition in the browser
  * CVE-2024-10465 (bmo#1918853)
    Clipboard "paste" button persisted across tabs
  * CVE-2024-10466 (bmo#1924154)
    DOM push subscription message could hang Firefox
  * CVE-2024-10467 (bmo#1829029, bmo#1888538, bmo#1900394,
    bmo#1904059, bmo#1917742, bmo#1919809, bmo#1923706)
    Memory safety bugs fixed in Firefox 132, Thunderbird 132,
    Firefox ESR 128.4, and Thunderbird 128.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1732708800">- Mozilla Thunderbird 128.5
  * fixed: IMAP could crash when reading cached messages
    (bmo#1931508)
  * fixed: Enabling "Show Folder Size" on Maildir profile could
    render Thunderbird unusable (bmo#1926279)
  * fixed: Messages corrupted by folder compaction were only
    fixed by user intervention (bmo#1929105)
  * fixed: Reading a message from past the end of an mbox file
    did not cause an error (bmo#1931258)
  * fixed: View -&gt; Folders had duplicate F access keys
    (bmo#1929925)
  * fixed: Add-ons adding columns to the message list could fail
    and cause display issue (bmo#1909621)
  * fixed: "Empty trash on exit" and "Expunge inbox on exit" did
    not always work (bmo#1896545)
  * fixed: Selecting a display option in View -&gt; Tasks did not
    apply in the Task interface (bmo#1927760)
  * fixed: Security fixes
  MFSA 2024-68 (bsc#1233695)
  * CVE-2024-11691 (bmo#1914707, bmo#1924184)
    Out-of-bounds write in Apple GPU drivers via WebGL
  * CVE-2024-11692 (bmo#1909535)
    Select list elements could be shown over another site
  * CVE-2024-11693 (bmo#1921458)
    Download Protections were bypassed by .library-ms files on
    Windows
  * CVE-2024-11694 (bmo#1924167)
    CSP Bypass and XSS Exposure via Web Compatibility Shims
  * CVE-2024-11695 (bmo#1925496)
    URL Bar Spoofing via Manipulated Punycode and Whitespace
    Characters
  * CVE-2024-11696 (bmo#1929600)
    Unhandled Exception in Add-on Signature Verification
  * CVE-2024-11697 (bmo#1842187)
    Improper Keypress Handling in Executable File Confirmation
    Dialog
  * CVE-2024-11698 (bmo#1916152)
    Fullscreen Lock-Up When Modal Dialog Interrupts Transition on
    macOS
  * CVE-2024-11699 (bmo#1880582, bmo#1929911)
    Memory safety bugs fixed in Firefox 133, Thunderbird 133,
    Firefox ESR 128.5, and Thunderbird 128.5
- Handle upstream changes with esr-prefix of desktop-file (boo#1233650)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1733227200">- Mozilla Thunderbird 128.5.1
  * new: Add end of year donation appeal (bmo#1925389)
  * fixed: Total message count for favorite folders did not work
    consistently (bmo#1924356)
- Tweak appdata-naming</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1734004800">- Mozilla Thunderbird 128.5.2
  * fixed: Large virtual folders could be very slow (bmo#1830145)
  * fixed: Message could disappear after moving from IMAP folder
    followed by Undo and Redo (bmo#1898706)
  * fixed: XMPP chat did not display messages sent inside a CDATA
    element (bmo#1929011)
  * fixed: Selected calendar day did not move forward at midnight
    (bmo#1757341)
  * fixed: Today pane agenda sometimes scrolled for no apparent
    reason (bmo#1930588)
  * fixed: CalDAV calendars without offline support could degrade
    start-up performance (bmo#1933099)
  * fixed: Visual and UX improvements (bmo#1913807,bmo#1930589)
  * fixed: Security fixes
  MFSA 2024-69 (bsc#1234413)
  * CVE-2024-50336 (bmo#1929264)
    matrix-js-sdk has insufficient MXC URI validation which could
    allow client-side path traversal</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1736424000">- Mozilla Thunderbird ESR 128.6
  * fixed: New mail notification was not hidden after reading the
    new message (bmo#1920077)
  * fixed: New mail notification could show for the wrong folder,
    causing repeated alerts (bmo#1926462)
  * fixed: macOS shortcut CMD+1 did not restore the main window
    when it was minimized (bmo#1857953)
  * fixed: Clicking the context menu "Reply" button resulted in
    "Reply-All" (bmo#1935883)
  * fixed: Switching from "All", "Unread", and "Threads with
    unread" did not work (bmo#1921618)
  * fixed: Downloading message headers from a newsgroup could
    cause a hang (bmo#1931661)
  * fixed: Message list performance slow when many updates
    happened at once (bmo#1933104)
  * fixed: "mailto:" links did not apply the compose format of
    the current identity (bmo#550414)
  * fixed: Authentication failure of AUTH PLAIN or AUTH LOGIN did
    not fall back to USERPASS (bmo#1928026)
  * fixed: Security fixes
  MFSA 2025-05 (bsc#1234991)
  * CVE-2025-0237 (bmo#1915257)
    WebChannel APIs susceptible to confused deputy attack
  * CVE-2025-0238 (bmo#1915535)
    Use-after-free when breaking lines in text
  * CVE-2025-0239 (bmo#1929156)
    Alt-Svc ALPN validation failure when redirected
  * CVE-2025-0240 (bmo#1929623)
    Compartment mismatch when parsing JavaScript JSON module
  * CVE-2025-0241 (bmo#1933023)
    Memory corruption when using JavaScript Text Segmentation
  * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873,
    bmo#1932169)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,
    and Thunderbird 128.6
  * CVE-2025-0243 (bmo#1827142, bmo#1932783)
    Memory safety bugs fixed in Firefox 134, Thunderbird 134,
    Firefox ESR 128.6, and Thunderbird 128.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738065600">- Mozilla Thunderbird ESR 128.6.1
  * fixed: Link at about:rights pointed to Firefox privacy policy
    instead of Thunderbird's (bmo#1941998)
  * fixed: POP3 'fetch headers only' and 'get selected messages'
    could delete messages (bmo#1930847)
  * fixed: 'Search Online' checkbox in saved search properties
    was incorrectly disabled (bmo#1937642)
  * fixed: POP3 status message showed incorrect download count
    when messages were deleted (bmo#1935800)
  * fixed: Space bar did not always advance to the next unread
    message (bmo#1468925)
  * fixed: Folder creation or renaming failed due to incorrect
    preference settings (bmo#1911225)
  * fixed: Forwarding/editing S/MIME drafts/templates unusable
    due to regression (bmo#1940605, bsc#1236411)
  * fixed: Sort order in 'Search Messages' panel reset after
    search or on first launch (bmo#1935073)
  * fixed: Reply window added an unnecessary third blank line at
    the top (bmo#1935938)
  * fixed: Thunderbird spell check box did not allow ENTER to
    accept suggested changes (bmo#1935401)
  * fixed: Long email subject lines could overlap window control
    buttons on macOS (bmo#1940201)
  * fixed: Flathub manifest link was not correct (bmo#1907695)
  * fixed: 'Prefer client-side email scheduling' needed to be
    selected twice (bmo#1862400)
  * fixed: Duplicate invitations were sent if CALDAV calendar
    email case did not match (bmo#1889607)
  * fixed: Visual and UX improvements
    (bmo#1875325,bmo#1901846,bmo#1939603,bmo#1855276)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1738756800">- Mozilla Thunderbird 128.7
  * fixed: Images inside links could zoom when clicked instead of
    opening the link (bmo#1917278)
  * fixed: Compacting an empty folder failed with write error
    (bmo#1935124)
  * fixed: Compacting of IMAP folder with corrupted local storage
    failed with write error (bmo#1935331)
  * fixed: After restart, all restored tabs with opened PDFs
    showed the same attachment (bmo#1858157)
  * fixed: Exceptions during CalDAV item processing would halt
    subsequent item handling (bmo#1940193)
  * fixed: Context menu was unable to move email address to a
    different field (bmo#1857469)
  * fixed: Security fixes
  MFSA 2025-10 (bsc#1236539)
  * CVE-2025-1009 (bmo#1936613)
    Use-after-free in XSLT
  * CVE-2025-1010 (bmo#1936982)
    Use-after-free in Custom Highlight
  * CVE-2025-1011 (bmo#1936454)
    A bug in WebAssembly code generation could result in a crash
  * CVE-2025-1012 (bmo#1939710)
    Use-after-free during concurrent delazification
  * CVE-2024-11704 (bmo#1899402)
    Potential double-free vulnerability in PKCS#7 decryption
    handling
  * CVE-2025-1013 (bmo#1932555)
    Potential opening of private browsing tabs in normal browsing
    windows
  * CVE-2025-1014 (bmo#1940804)
    Certificate length was not properly checked
  * CVE-2025-1015 (bmo#1939458)
    Unsanitized address book fields
  * CVE-2025-0510 (bmo#1940570)
    Address of e-mail sender can be spoofed by malicious email
  * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694,
    bmo#1938469, bmo#1939583, bmo#1940994)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20,
    and Thunderbird 128.7
  * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984)
    Memory safety bugs fixed in Firefox 135, Thunderbird 135,
    Firefox ESR 128.7, and Thunderbird 128.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1739966400">- Mozilla Thunderbird 128.7.1
  * fixed: Users may not have been notified if messages arrived
    in multiple folders at once. (bmo#1941911)
  * fixed: Message list scrolled to the wrong place on start-up.
    (bmo#1917465)
  * fixed: Unified folders could become unusable instead of being
    automatically rebuilt. (bmo#1927048)
  * fixed: Some messages may have been threaded incorrectly in
    unified folders. (bmo#1939725)
  * fixed: Middle-click autoscroll cursor appeared without arrows
    instead of expected design. (bmo#1946189)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1741262400">- Mozilla Thunderbird 128.8
  * fixed: Opening an .EML file in profiles with many folders
    could take a long time. (bmo#1948678)
  * fixed: Users with many folders experienced poor performance
    when resizing message panes. (bmo#1860094)
  * fixed: "Replace" button in compose window was overwritten
    when the window was narrow. (bmo#1948427)
  * fixed: Export to mobile did not work when "Use default
    server" was selected. (bmo#1930728)
  * fixed: "Save Link As" was not working in feed web content.
    (bmo#1948532)
  * fixed: Security fixes
  MFSA 2025-18 (bsc#1237683)
  * CVE-2024-43097 (bmo#1945624)
    Overflow when growing an SkRegion's RunArray
  * CVE-2025-1930 (bmo#1902309)
    AudioIPC StreamData could trigger a use-after-free in the
    Browser process
  * CVE-2025-1931 (bmo#1944126)
    Use-after-free in WebTransportChild
  * CVE-2025-1932 (bmo#1944313)
    Inconsistent comparator in XSLT sorting led to out-of-bounds
    access
  * CVE-2025-1933 (bmo#1946004)
    JIT corruption of WASM i32 return values on 64-bit CPUs
  * CVE-2025-1934 (bmo#1942881)
    Unexpected GC during RegExp bailout processing
  * CVE-2025-1935 (bmo#1866661)
    Clickjacking the registerProtocolHandler info-bar
  * CVE-2025-1936 (bmo#1940027)
    Adding %00 and a fake extension to a jar: URL  changed the
    interpretation of the contents
  * CVE-2025-1937 (bmo#1938471, bmo#1940716)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
  * CVE-2025-1938 (bmo#1922889, bmo#1935004, bmo#1943586,
    bmo#1943912, bmo#1948111)
    Memory safety bugs fixed in Firefox 136, Thunderbird 136,
    Firefox ESR 128.8, and Thunderbird 128.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1742385600">- Mozilla Thunderbird 128.8.1
  * fixed: PGP/MIME signed message with a missing signature did
    not display (bmo#1948274)
  * fixed: Some emails forwarded as attachments used the wrong
    MIME type (bmo#1839010)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1743595200">- Mozilla Thunderbird ESR 128.9
  * new: Thunderbird now has a notification system for real-time
    desktop alerts (bmo#1936307)
  * fixed: Data corruption occurred when compacting IMAP Drafts
    folder after saving a message (bmo#1909111)
  * fixed: Right-clicking "Decrypt and Save As..." on an
    attachment file failed. (bmo#1952823)
  * fixed: Thunderbird could crash when importing mail
    (bmo#1953574,bmo#1953576)
  * fixed: Sort indicators were missing on the calendar events
    list. (bmo#1914085)
  * fixed: Security fixes
  MFSA 2025-24 (bsc#1240083)
  * CVE-2025-3028 (bmo#1941002)
    Use-after-free triggered by XSLTProcessor
  * CVE-2025-3029 (bmo#1952213)
    URL Bar Spoofing via non-BMP Unicode characters
  * CVE-2025-3030 (bmo#1850615, bmo#1932468, bmo#1942551,
    bmo#1951017, bmo#1951494)
    Memory safety bugs fixed in Firefox 137, Thunderbird 137,
    Firefox ESR 128.9, and Thunderbird 128.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1744804800">- Mozilla Thunderbird 128.9.2
  * fixed: Two-factor auth via text or email did not work with
    Office 365 using Oauth2. (bmo#1907115)
  * fixed: IRC channel was not visible after restart.
    (bmo#1941386)
  * fixed: Global indexing failed when processing email with
    invalid calendar data (bmo#1916063)
  * fixed: Security fixes
  MFSA 2025-27 (bsc#1241277)
  * CVE-2025-3522 (bmo#1955372)
    Leak of hashed Window credentials via crafted attachment URL
  * CVE-2025-2830 (bmo#1956379)
    Information Disclosure of /tmp directory listing
  * CVE-2025-3523 (bmo#1958385)
    User Interface (UI) Misrepresentation of attachment URL
- Mozilla Thunderbird 128.9.1
  * fixed: Added delay to built-in notifications when new profile
    is created in offline mode (bmo#1957923)</changelog>
</package>
<package pkgid="9d2959909a8336496fe4c4e85c8017decdf6fa662a3485e52a461c78f50549b3" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2d5a6e17674afbed0784b8cd91a1b38de65c7e46e56de490433fdfe742a3baaa" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2434d2111245b044045f77bb20ba44f6a6d5c94558adba178ee8c276852bc330" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bf5f91906c807afa7dba30b0c42ca590e5bc112a04054238e3c188b47ceef55a" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58a244f355b892cfaae060bbcb95748e80469ec0c82f7aabc142fb0a47535cf6" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="baed7e5c564c8d815113e5db32f9c095aa47e326fc5f4142765bd47100a2248a" name="NetworkManager-applet" arch="aarch64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="0ab17d76000e8d2d7836c892ab20bdc2cb5c4167720e1a1ee9f6808bb1132b8a" name="NetworkManager-applet" arch="ppc64le">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="b773219fc412e11d045cc070a9306ebb36c0087c65a2c76ffb2ca3896e4dbf5a" name="NetworkManager-applet" arch="s390x">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="2f20e0ca16952b7ee09ca0d0fa5301eef1cea869668fcab42e7a8291cdc7cfca" name="NetworkManager-applet" arch="src">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="07d62b8f5e35195b044e36add5a9f387348bc8f7be4eb73593481b6a0e145c4d" name="NetworkManager-applet" arch="x86_64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="5242e3333bf09e3905a8e8f489c16ec44c5df5d9607887c1642f6a93b95cad55" name="NetworkManager-applet-openvpn" arch="aarch64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="84a2559650afa7c704385b1ee60b96f7151c0e2dd1693fdc22f228e35d4fdb13" name="NetworkManager-applet-openvpn" arch="ppc64le">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="af76b090f43e40a09ace487a68652df454247cfee526a278616502e87808520d" name="NetworkManager-applet-openvpn" arch="s390x">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="209a6a3aee25d55bf8cc710b6d5d99126652a70234093dec71f40b1019d51e91" name="NetworkManager-applet-openvpn" arch="x86_64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="b24e48ba95bc28c01ef6bc277a897e6411d724de0d647c76c6912ff9781a5052" name="NetworkManager-bluetooth" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1f91aa4cb262e178770def0a546ff9bdb4dbea557c1cc8a287b02cc003dbaf83" name="NetworkManager-bluetooth" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1678c151c7ff858bd58f1bf8861d3ba2d0941272e3ad356d14db11accac679d2" name="NetworkManager-bluetooth" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f676c6315a934f5da997599a4ebe8a7065c83f5c05885ffccc39656ca3a83a6d" name="NetworkManager-bluetooth" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a325f57058452704a35e7b0d57fcfad332c31d689502c83c972a83ca19ef1ad3" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cb6dd12beeb93e8ced46ca422890b01d85b1f87e16d7a5d56e6e5d5c9291039a" name="NetworkManager-cloud-setup" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="78c3b649afaf92f8d263a3fd8e7e7da86140bf1c4fe6ca12ad5fd21cb4545585" name="NetworkManager-cloud-setup" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e35fe7059fc7b50925656e31deeeb9a1492958d09e16d0420eac6bebe6401a1c" name="NetworkManager-cloud-setup" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e61672434148e4e2660e8d8d38281abdd1ed782fcdede0cae32603d6e50ba2e9" name="NetworkManager-cloud-setup" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="97997c3638a9b3cfa4ed2ccab6fd44479983925e2ceb10501e3c693031acab54" name="NetworkManager-connection-editor" arch="aarch64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="b1fe9312104df5bdceb93f9973b1eaa39bb15b12dd524eacbb480c5a805ba1f5" name="NetworkManager-connection-editor" arch="ppc64le">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="456f8982c7b819a224f3c3d64b9d4cf57c486201e682f4083ba61b25b78903e4" name="NetworkManager-connection-editor" arch="s390x">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="014f63110f50ccd5a3072e8b3311a1b46d14e1d6223a262b05ce1e2669ae878b" name="NetworkManager-connection-editor" arch="x86_64">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="af8b60c8d0059bf799be683c447cdb69053928e9d1517152516e1a9c08113157" name="NetworkManager-connection-editor-lang" arch="noarch">
  <version epoch="0" ver="1.34.0" rel="150600.3.2.1"/>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to reduce differences
  between Leap and SLE(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1588852800">- Make NetworkManager-connection-editor require
  mobile-broadband-provider-info so that it can function properly
  (bsc#1169878).</changelog>
  <changelog author="simonf.lees@suse.com" date="1589198400">- Actually continue to build with appindicator support (needed for
  the multiple openSUSE Desktops that still use nm-applet(jsc#SLE-11797).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1591272000">- Make libnma require mobile-broadband-provider-info(bsc#1172499).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1592913600">- Update to version 1.18.0:
  + Enable build with appindicator by default.
  + Add WireGuard support to the editor.
  + Support OWE (Opportunistic Wireless Encryption) in the editor.
  + Fix crash when disposing VPN secret dialog.
- Switch to using tarball release, drop usage of source service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1612353600">- Update to version 1.20.0:
  + Use wireless-security code from libnma.
  + Add flatpak build configuration.
  + Applet:
  - Hide unmanaged ethernet devices in nm-applet.
  - Fix Wi-Fi scan requests with appindicator.
  - Add stock symbolic icons.
  + Editor:
  - Fix drop down list for connection.secondaries.
  - Remove NotShowIn=GNOME.
- Drop
  NetworkManager-gnome-bsc1003069-default-agent-owned-secrets.patch:
  patch needs to be moved over to libnma.</changelog>
  <changelog author="dimstar@opensuse.org" date="1620993600">- Update to version 1.22.0:
  + Support activating WireGuard connections as VPNs from the
    applet.
  + Fix nm-connection-editor crash when evaluating secondary
    connections.
  + Show missing toggle in the 802.1X security page of the editor.
  + Fix updating Polkit permission in the editor.
  + Adapt peers table in the WireGuard editor page when the window
    is resized.
  + Update translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1628769600">- Replaces Requires nma-data with a Conflicts on older version,
  to please installchecker.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1629201600">- Update to version 1.24.0:
  + If Polkit permissions allow it, create system connections
    (instead of user-restricted ones) when clicking on a Wi-Fi
    network in the applet.
  + Fix display of blurry applet icon.
  + Use the "port" word for dependend devices and profiles in the
    editor.
  + Support storing and retrieving WireGuard preshared-key
    into/from a keyring.
  + Update translations.</changelog>
  <changelog author="sbrabec@suse.com" date="1631620800">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing no longer used nor recognized options
  introspection=true and libnm_gtk=false to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add 107.patch: Fix build with meson 0.61.0 and newer.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647950400">- Update to version 1.26.0:
  + Improve error messages and error dialogs.
  + Improve Wi-Fi security combo error handling.
  + Stop providing WEP by default.
  + Replace the lock icon for WEP networks with an exclamation
    mark.
  + Fix meson 0.61 issues.
  + Make the tooltip of the status icon available for
    screen readers.
  + Fix OWE wireless security option not showed
    on "Connect to a Hidden Network" dialog.
  + Fix OWE wireless security option not being saved
    when chosen from nm-connection-editor.
  + Move 802.1 dialog margins for the inner vbox.
  + Align labels for Ethernet dialog.
  + Move all Wi-FI entries to a submenu.
  + Fix the VPN plugins dialog margins.
  + Add a scrolled window for the VPN page.
  + Internal improvements.
  + Update translations.
- Drop disabled nm-applet-private-connection.patch: We have not had
  this patch enabled for 6 months, and so far no bugs filed. Debian
  had a similar patch, and they too have dropped it, so it seems to
  no longer be needed.
- Drop 107.patch: Fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1654689600">- Update to version 1.28.0:
  + Use correct font size for headings in order to make lives of
    HiDPI a little less miserable.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1667908800">- Update to version 1.30.0:
  + wifi: change description for wpa-psk to include also WPA3.
  + editor: remove unused fields from wifi page.
  + applet: replace libnotify with GNotification.
  + gschema: bring back org.gnome.nm-applet schema.
  + Updated translations.
- Drop pkgconfig(libnotify) BuildRequires: no longer needed.
- Rebase feature-app-indicator-desktop-file.patch.
- Conflict with libnma0 &lt; 1.10.4: the glib schema was upstream
  wrongly moved to libnma, even though only a part of it was
  supposed to be there. libnm 1.10.4 fixes this situation.</changelog>
  <changelog author="yfjiang@suse.com" date="1670328000">- Add meson-0.61-build-fix.patch to fix the build on meson &gt;= 0.61
  (jsc#PED-2644, glgo#GNOME/network-manager-applet!107)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681646400">- Update to version 1.32.0:
  + Allow using MTU larger than 10000 octets.
  + Prefer using AppIndicator outside X11.
  + Added support for importing WireGuard profiles from wg-quick
    files.
  + Updated translations.
- Drop meson-0.61-build-fix.patch: fixed upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696420800">- Update to version 1.34.0:
  + Fix crash when importing WireGuard connections.
  + Fix ineffective "Don't show message again" button in
    notifications.
  + Drop build dependency on gudev.
  + Add setting to suppress broadband unlock prompt.
  + Replace occurrences of "master", "slave" and "blacklist".
  + Updated translations.
- Drop long disabled polkit-devel BuildRequires, patch it was
  needed for is dropped.
- Drop pkgconfig(gudev-1.0) BuildRequires: No longer needed
  following upstream changes.
- Rebase feature-app-indicator-desktop-file.patch with quilt.
- Pass sysconfdir=%{_distconfdir} to meson setup, move to UsrEtc.
- Pass b_lto=true to meson setup, use link time optimization.
- Add fdupes BuildRequires and macro, remove duplicate files.
- Move translations to NetworkManager-connection-editor-lang,
  replace the NetworkManager-connection-editor Recommends with a
  hard Requires. Also add Obsoletes and Provides to ease updates.
  The reason for moving the translations are as follows: One can
  install NetworkManager-connection-editor without needing
  NetworkManager-applet, so in order to make the translations for
  NetworkManager-connection-editor installable without pulling the
  dependencies of NetworkManager-applet.</changelog>
  <changelog author="yfjiang@suse.com" date="1697630400">- Support build environments like SLE 15 SP5 and Leap 15.5 which
  had %{_distconfdir) not defined yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %autosetup instead of %setup/%patch.</changelog>
</package>
<package pkgid="bc1bf0439cb48956be8fab55b4d84c491b4badeb7d3d0e19c35d3559b54657ab" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cc00818ff7b976130280080242b6fea205647599e2bf8de04595ffb213445318" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2c6efe42e2406658b61e4c7de8056b481038e7be9ba0652468be363b45ae2c31" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="5cca66d1b05df05f577921362ab27b4375ab5bfb578d690d29e5ab11f704b06f" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f5940436f1957588697ecd379699ce97fc9d4af4a6c1d957d91ed21ed6fa8ad0" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8a3d957a31e706c127555a87df96e9282e44d05e71ef5680dc865d63051e2c4f" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="97faca2f27c4b9773ed6fc9ae4a1aaf4bd0efa643f1de2cf9fd1dd22c560f8ec" name="NetworkManager-openvpn" arch="aarch64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="5451940c22b3a7d0c27c42ca090da5f4f18888e7b584ba4594d5150c9ea9442f" name="NetworkManager-openvpn" arch="ppc64le">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="4a53d8caa90fe8f4aa9db03c94152ea932cf7f1fa77a9bac2242e48ed7a6aa65" name="NetworkManager-openvpn" arch="s390x">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="8ebb2796127912b76b1dc3d32b43d02fffe854e3dfd51ba3d91039039f1d70c9" name="NetworkManager-openvpn" arch="src">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="7fdfd29fa82e098de8654863a003b977f2364e42c4f6812871f4c23a38211979" name="NetworkManager-openvpn" arch="x86_64">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="41e87367f3c689a9a167ab98a00afa0b638fed282a975c0632bb37c4063a1840" name="NetworkManager-openvpn-lang" arch="noarch">
  <version epoch="0" ver="1.10.2" rel="150600.4.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.8.6:
  + Don't validate auth parameter and pass it directly to openvpn.
  + Fix endless loop checking for encrypted certificate.
  + Sanitize newlines in export ovpn file.
  + Improve project description in doap file.
  + Various minor bugfixes and improvements.
  + Updated translations.
- Use autosetup and make_build macros.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1539777600">- Update to version 1.8.8:
  + Fix a memory corruption bug in the advanced dialog.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 1.8.10:
  + Fix changing the proxy port in the editor.
  + Drop the file extension check when importing a file.
  + Support loading the editor shared object from the same
    directory of plugin for development purposes.
  + Updated translations.</changelog>
  <changelog author="stefan.pledl@mesutronic.de" date="1556712000">- Enable missing whirlpool HMAC authentication (boo#1132946).
  + fix-for-missing-whirlpool-hmac-authentication.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1579176000">- Stop recommending NetworkManager-openvpn-lang: the -lang package
  provides relevant supplements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1583496000">- Update to version 1.8.12:
  + The auth helper in external UI mode can now be run without a
    display server. Future nmcli version will utilize this for
    handling the secrets without a graphical desktop.
  + libnm-glib compatibility (NetworkManager &lt; 1.0) is disabled by
    default. It can be enabled by passing --with-libnm-glib to
    configure script. Nobody should need it by now. Users that
    still use this are encouraged to let us know before the
    libnm-glib support is removed for good.
  + Add support for the following OpenVPN options: tls-version-min,
    tls-version-max, compress.
  + Support inline CRL blobs during import.
  + Allow option mssfix to be set to zero.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1588334400">- Set the path for the VPN service name file correctly to
  %_vpnservicedir (provided by macros.NetworkManager).</changelog>
  <changelog author="dimstar@opensuse.org" date="1618660800">- Update to version 1.8.14:
  + Add support for the following OpenVPN options: push-peer-info,
    remote-random-hostname, tls-crypt-v2.
  + Add --explicit-exit-notify by default when using UDP.
  + Fix compatibility issues with OpenVPN 2.5.0.
  + Update translations.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622721600">- Change to using systemd-sysusers</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="songchuan.kang@suse.com" date="1623844800">- Add nm-openvpn-bsc#1186091.patch: service: Don't add cert and key
  when they are not set
  (glgo#GNOME/NetworkManager-openvpn!38, bsc#1186091).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632916800">- Update to version 1.8.16:
  + Fix detection of OpenVPN 2.5.0
  + Allow the connection to persist across network failures when
    the VPN profile has 'vpn.persistent=yes'
  + Fix parsing of incomplete IPv6 configurations pushed by server
  + Improve logging message about deprecated tls-remote option
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1647086400">- Update to version 1.8.18:
  + Gtk4 version of the editor plugin is now available (for use
    with Control Center of GNOME 42 or later).
  + Updated translations.
- Drop nm-openvpn-bsc#1186091.patch: Fixed upstream.
- Rebase patch with quilt.
- Add pkgconfig(gtk4) and pkgconfig(libnma-gtk4) BuildRequires and
  pass --with-gtk4=yes to configure, build the gtk4 version.
- Stop passing --without-libnm-glib to configure, no longer
  needed, nor recognized.
- Pass --enable-lto=yes to configure, build using LTO support.
- Add optional libxml2-tools BuildRequires, build runs
  xml-stripblanks preprocessing if available.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661774400">- Update to version 1.10.0:
  + Add support for "allow-compression" parameter.
  + Fix a regression in preserving the "tls-auth" settings.
  + Add support for "tls-min" and "tls-cipher" parameters.
  + Include the new gnome-control-center name in the AppData file.
  + Drop libnm-glib support, nobody is likely using it anymore.
  + Fix importing profiles with a PKCS#12 CA.
  + Make sure the plugin object links with glib.
  + Dropped dependency on intltool.
  + Updated translations.
- Drop intltool BuildRequires following upstream changes.
- Rebase patch with quilt.</changelog>
  <changelog author="dimstar@opensuse.org" date="1668772800">- Update to version 1.10.2:
  + IP condfiguration is no longer required in TAP mode.
  + Fix initialization of secret flags.
  + Add support for DOMAIN-SEARCH option.
  + Set data-ciphers option with chosen cipher.
  + Update translations.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1694174400">- Add nm-openvpn-fix-importing-pkcs12-ca.patch: import: fix
  importing profiles with PKCS#12 CA
  (glgo#GNOME/NetworkManager-openvpn!50, bsc#1214415).
- Drop nm-openvpn-fix-importing-pkcs12-ca.patch: fixed upstream.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1698926400">- Rename gnome subpackage to NetworkManager-applet-openvpn
  to more accurately reflect its usage
- Add missing supplements:
  - NM and openvpn
  - NMA subpackage: Main package and NMA</changelog>
  <changelog author="songchuan.kang@suse.com" date="1711627200">- Add missing supplements(bsc#1220391):
  + NMA subpackage: Main package and gnome-control-center</changelog>
  <changelog author="songchuan.kang@suse.com" date="1741089600">- Add nm-openvpn-fix-crash.patch: service: fix a crash when empty
  password is provided (glgo#GNOME/NetworkManager-openvpn!92,
  bsc#1237570).</changelog>
</package>
<package pkgid="ff1d43362f378c4f004e2ab95467f1d75f9d5ad2bfb31b40e5d90063b7aec4a7" name="NetworkManager-ovs" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8fd7d835c2715415175b95b97f21f2d0754c4cc24a9fca2827c99f5544f8c696" name="NetworkManager-ovs" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="fbb855f3518d417848b2d6f38fad73d60eb490200b5ef85d47bc488da4c5c87a" name="NetworkManager-ovs" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6bff24ee0db2972f964a0c298ff61a648e85aaaac5990ecddd2d5191d90f934" name="NetworkManager-ovs" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f24728c555a281cc7a7421318bcf6dbb42a2916b71476b0a2b45f4a06605a172" name="NetworkManager-pppoe" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="91bcb0303ddf11142484dc2850649abee269ddfecf8c3899ec8fe4d8771f8943" name="NetworkManager-pppoe" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58315657c14e29ae92d3b7b7eec86b65fdd11e3732355df3918a38ffcf4b62a3" name="NetworkManager-pppoe" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8364de7a3caa1d44c5b13606186e275203fbad492dd31a0ed7d71e6ad6680bf5" name="NetworkManager-pppoe" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e75e4271d1798bbbce4307c9ee38d5c5a226885b99c53403b30b82eb2914cb0b" name="NetworkManager-tui" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6362dfbec2ac0748f5b9822a8d70cd9a5600e82238046f875842eafb93bfab3" name="NetworkManager-tui" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="633701cf772a73d24f48c4f89bc72cfd9ba7ba64b36250f15883cefa96d9db48" name="NetworkManager-tui" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8e7a35a106a9202ee7e4b7f592ea4d809edaad86f8d55a5888533a95d17af503" name="NetworkManager-tui" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="36df225b0b4ba5efd6efa1a66c5a4b80873888d25519de154d02bc13315a8088" name="NetworkManager-wwan" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="dc38789a135fd180d418a256f779ae329a2334e92ea8eaf9dc385d4d0130a92d" name="NetworkManager-wwan" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1cf37e03d27bfcc2eb0c7df0164045ba9d90d5ebe53a00d4fe289bbcdd965e04" name="NetworkManager-wwan" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ac7bf279a3264b6c47adbaa5a02599eaab5d355739f0d3912be91e027beb1593" name="NetworkManager-wwan" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a616ef50501a1eab0baff115549c723cd68f43f3068e86e316baef428ad2b1ad" name="OpenIPMI" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="05a268c5077664b2dead41e3eb28b48a8fe9d880f91de6d4998395fe065ff3e4" name="OpenIPMI" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="33daf99481879d9a3b75f2664c0f5d39127b365570f2f0a283afa05fc3b4a05f" name="OpenIPMI" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="77b8ab3ec0554b4c9bbdd2520e1b771d3a4b1510fbc04cd93cb6c24fbbe9831d" name="OpenIPMI" arch="src">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="41a3568c88aeac1be0758dd4de0d49b7b696325a5858e3aa09cd3e60fa95f206" name="OpenIPMI" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2361dfff3824112c31f4aa6c3c527f28b792bc10cb8fd83414ef620716847e26" name="OpenIPMI-devel" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="2d6d02b1c8bd49ab7d11d7e5103ec68757e4eec8966cebf378778b52a6a4a4ba" name="OpenIPMI-devel" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="68542b5b49bd06009bac5f48c7c0e3b27736cc2d10566d1f595461ef89d400ef" name="OpenIPMI-devel" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="229b046963f1f71eb162b555a72a692f3f4599957b907c3305eab4df48c1bf66" name="OpenIPMI-devel" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="d61728a1500d6a35e49c4fc4dae7096438f0eb110fef79a07b7dcf5aed13abb8" name="OpenIPMI-python3" arch="aarch64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="ddf6c405490ab5f70b61d2306e6b1ad05cf27068b2a9b2ff13c86d5e2d3a3c3a" name="OpenIPMI-python3" arch="ppc64le">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="91affa7378eac222dc8df7089065c88fb8f7a2aecf5e0bff2733bc25a92404d9" name="OpenIPMI-python3" arch="s390x">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="a11181aeb979188338f61b4a3193906e8b69aa861928d2ec0e64a0e4a21f8795" name="OpenIPMI-python3" arch="x86_64">
  <version epoch="0" ver="2.0.31" rel="150600.10.3.1"/>
  <changelog author="trenn@suse.de" date="1456488000">- Update to latest git commit:
  a01bbe94efff3a5f239b3b5440c8..052d36ec88515c1b1177faa442833e3
  Add: OpenIPMI_2.0.21_to_HEAD.patch
  Removed modifications for:
  - lanserv/ipmi_sim_chassiscontrol
  - lanserv/marvell-bmc/TODO
  due to git repo inconsistencies
- Some spec file cleanups obs complained about
  - &gt; also spec-cleaner run through</changelog>
  <changelog author="trenn@suse.de" date="1457352000">- Fix perl requires by using the pre-defined macro (bsc#969576)</changelog>
  <changelog author="dimstar@opensuse.org" date="1457438400">- Remove one occurence of perl_requires: once is sufficient.</changelog>
  <changelog author="fgerling@suse.com" date="1473854400">- Update spec file to properly install sysconfig.ipmi (bsc#989985, bsc#988443)</changelog>
  <changelog author="tchvatal@suse.com" date="1498564800">- Version update to lates trelease 2.0.23:
  * There is no longer actively updated changelog
  * Various bugfixes since last git pull from 2016-02-26
- Drop OpenIPMI-libtool.patch which was merged upstream
- Drop OpenIPMI_2.0.21_to_HEAD.patch patch as it is no longer
  needed
- Add patch openipmi-tinfo.patch to detect tinfo properly
- Add patch to fix OpenIPMIpthread pc file (from Fedora)
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Add patch to not bundle libedit (from Fedora)
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch</changelog>
  <changelog author="josef.moellers@suse.com" date="1506340800">- Upgrade to 2.0.24
  * Mainly code cleanup and small rewrites.
  * Variable renaming IPMI_... to OPENIPMI_...
  * Improved internal error handling
  * IPv6 support added/completed.
  [fate#322830, OpenIMPI-add-libncurses.patch,
  OpenIPMI-no-return-in-nonvoid-function.patch]</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1516363200">- * added a section defining IPMI_SI_MODULE_NAME to sysconfig.ipmi
  * added code to OpenIPMI.spec/%install to modify sysconfig.ipmi
    according to architecture
  * modified openipmi-helper to load "sysconfig.ipmi" AFTER setting
    default IPMI_SI_MODULE_NAME=ipmi_si
  [bsc#1059820, OpenIPMI.spec, openipmi-helper, sysconfig.ipmi]</changelog>
  <changelog author="dimstar@opensuse.org" date="1532520000">- Replace usage of deprecated py_sitedir macro with
  python_sitearch.</changelog>
  <changelog author="trenn@suse.de" date="1536321600">- Update to latest version 2.0.25 plus latest fixes (fate#326195):
- A    OpenIPMI-2.0.25..HEAD_git.diff
  Patch to latest git commit:
  commit 4ac55d7dc7016c9e5f0c474f69f4e64e7aacac42
  Date:   Wed Jul 18 13:59:29 2018 -0500
    unix: Add a way to clear fd handlers with no callbacks
  I had to manually edit git diff v2.0.25.. and remove .gitignore deletion
  to patch succesfully. Build service wants to have the original
  .tar.gz tarball from sourceforge.
  I also had to add the bootstrap file which seem to exist in git sources
  but not in the exported tarball, even it is not listed in .gitignore:
  A bootstrap
  OAD
  0001-Apply-OpenIPMI-2.0.18-pthread-pkgconfig.patch.patch
- Adjusted patches:
  M    0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch
  M    fix-conversions.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    openipmi-tinfo.patch
- Fix build service error (use /usr/bin/python3 in shebang instead of env
  A    use_python3_shebang
- Build documentation (IPMI.pdf) ourselves as IPMI.pdf vanished from sources
  For this quite some build requires had to be added as well
  A    fix_dia_version_detection.patch</changelog>
  <changelog author="jengelh@inai.de" date="1536667200">- Use noun phrase in summary. Ensure neutrality of description.
- Update unspecific summaries of subpackages.
- Drop --with-pic which is only relevant for static libs.
- Speedier /usr/bin/find call.</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Use noun phrase in summary. Remove em dashes from summaries.
- Implement shared library packaging policy.</changelog>
  <changelog author="josef.moellers@suse.com" date="1579521600">- Update to latest version 2.0.28
  * Fixed a number of potential buffer overruns by appending a NUL
    character to strncpy'd strings.
  * switched from editline to readline
  * some variable and function renaming to avoid leading
    underscores
  * more changes, no documentation available (ChangeLog file
    is unchanged!)
  * Two patches now obsolete.
  [OpenIPMI-2.0.25..HEAD_git.diff,
  0003-Apply-OpenIPMI-2.0.21-nobundle.patch.patch,
  OpenIPMI-2.0.28.tar.gz]</changelog>
  <changelog author="dmueller@suse.com" date="1597665600">- update to 2.0.29:
  * Add an external definition for ipmi_malloc_shutdown()
  * Pass 0 to snprintf size when calculating real size
  * selector: Fix a signed/unsigned comparison
  * selector: Fix handling if pselect() returns 0
  * selector: Return the right value for timer already in use
  * selector: Cause the read handler to be called on an exception
  * selector: Fix multi-threading issues
  * selector: Add an selector call to install a sigmask
  * For for brokenness with fork() and epoll()
  * Fix a deadlock when freeing a running timer
  * lanserv: Allow individual group extensions to be registered
  * Include readline history headers where needed</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1615204800">- drop -fPIC from CFLAGS which breaks our gcc-PIE profile resulting in
  non-position independent binaries and thus weakened security (bsc#1183046).</changelog>
  <changelog author="mcepl@suse.com" date="1624881600">- Use Python3 instead of Python2 (bsc#1190999).</changelog>
  <changelog author="trenn@suse.de" date="1625832000">- Update to version 2.0.31
  Adopted patches to latest sources:
  M    OpenIMPI-add-libncurses.patch
  M    OpenIPMI-no-return-in-nonvoid-function.patch
  M    OpenIPMI-prefer_perl_vendor.patch
  M    fix_dia_version_detection.patch
  M    openipmi-tinfo.patch
  * sample: Prefer glib for solterm instead of posix
  * sample: Remove -rdynamic from openipmicmd
  * smample: Compile ipmicmd with glib if it is available
  * glib: Allow NULL timeout to perform_one_op()
  * lanserv: Fix an issue with rmcp sending
  * Rework mcserv.h so that marvell-mod can get what it needs
  * lanserv: Move sol_init_mc() into sol code
  * lanserv: Remove all calls from the library to user code
  * Move ipmi_log() to ipmi_log.h
  * ui: export ipmi_ui_cb_handlers
  * ui: Add link libraries to UI library
  * Add -no-undefined to all shared library links
  * Rework ipmi_cmdlang_report_event()
  * Rework ipmi_cmdlang_global_err()
  * Get rid of posix_vlog()
  * lanserv: Use recv, not read, for a network socket
  * A lot windows (DLL, winsock, etc.) enhancements
- Update to version 2.0.30:
  * Switch to python3 by default
  * lanserv: Fix some various bugs
  * sol: Fix some various bugs
  * sdrcomp: Fix some memory leaks
  * sol: Fix some packet handling errors
  * solterm: Clean things up at shutdown
  * Fix a leak in the selector code
  * sol: Rewrite the library code
  * sol: Return errors from close if the send fails
  * Reconfigure the transmitter on a reconnect
  * Refuse writes greater than 255 bytes
  * lan: Fix timer cleanup
  * Fix init/shutdown issues with mcs and domains
  * Fix shutdown on error issues
  * Fix a memory leak at initialization
  * selector: Make the timer stop with done work right when handler running
  * Add parameters to let the lan timeouts be specified
  * initscript: Don't delete ipmi devices if udev created them
  * selector: Rework to allow an arbitrary number of fds with epoll
  * Don't disable fd handlers before setting one up
  * Don't crash if passed in fd is &gt;= FD_SETSIZE</changelog>
  <changelog author="trenn@suse.de" date="1632830400">- Add latest mainline fixes:
  A    lanserv-Add-the-judgment-on-the-validity-of-length-in-emu_cmd.c-and-session-in-lanserv_ipmi.c.patch
  A    unix_thread-Remove-the-fd-handler-sets-before-it-s-set-up.patch</changelog>
  <changelog author="trenn@suse.de" date="1633521600">- Enhance changelog as demanded in an internal submitrequest</changelog>
  <changelog author="trenn@suse.de" date="1727352000">- Fix bsc#1229910 CVE-2024-42934 by below 2 patches:
  A lanserv-Check-some-bounds-on-incoming-messages.patch
  A lanserv-Fix-an-issue-with-authorization-range-checking.patch</changelog>
</package>
<package pkgid="edf10d74afe9a5808353fcd4a700aca72b8fc9574991766c0942c47c7ec872d7" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="242a35e782f1c2cf52764cc47c40b35ff9027386edcb75a993cacdd18ea88e05" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="61e8cb31f92e27f52e2a8514eb18ef46f997632c80a862a6d3800d57758f22ff" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="91558d9c65dabb869a2290172333fd457dd4ba782830cf3f79442c763bcc3ed2" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7cda6daa85e46ec139dd7abe310c6cd157c3d29c8adee4600d6a0bd827937935" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="1f78ebaf8a198e9411b1a97dd2feb26b676fd122b639cb8126478d4c8993c290" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5f04ee7ce71cd6fe18985f865b8086a1f5798a1c9d8d0f70eb0d45d2a5103478" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b00e5fd218d9b1a50ef946b9afa129824a92f2e11e3ded338925674b4db2f845" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="81ae56efda9a56a1828b2459d67dfd5149d98a2f863cb355eeb5f490b1d7e9c7" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="87b57be163e5f870c5289d08368ac974065e36cdbb38ac31432b60423145a77b" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="16cb26bc57089d9cb73053dde8b23f61ac4bc91a04485e6c9dbe1f7490938555" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="e87fc2aeb1fe45ba1b6605100b53d14447022a2fc199ada51e6b2b5c88eb30e6" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bd84b033efd0f024bcab110d7c16a54efd2d704c315b1cb6cda1d6db5354ec3b" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c8e7608ef440349d74d747f576560f62d0bcb38987cc54a9e7b31647394d488b" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="9293c2adb3982354e698af7b0a2bb4a47030646eba28f5704c0abc4c2fde4bb2" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="f8d88ef5fb7c3013da12afe46633b72f0f023a13978fec668fb303c95947e9c6" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3f7c48731c1e413d112f0f414915fa8ce493414a9b534804c1e805498290d73b" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="e6eb0b2a2a65c7226a5995857f43f45a4d555f4f65f11f408392b620228eb34b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="34ebac62adc360720ff2a82031a8d24ce7bde64091a30ca8f52c0ce578be5f54" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="15e562ac20e61bab022fa6780f28dd560ddcbbf903af74641df835d57cbea684" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="71bba0f18aece203106bbed861f5b6e307207aceb7f42554980f319872f76581" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="dcd2eec48560422ca7f49b0700368e88e9ab5e557c98ed0d051778017633d647" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d64ea88b0e84cd5a3303b7a96b0ef86f90e60995d958d9ec84f70928050cb2d5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b4d8a4f12728c4000b3a8aceb58eac70cd31dd904d50256c12d844b7ec959fdf" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="af36ef107ed66ccec28519a5c7d3a8273fb6f53688228a5d53e30e24ac23b516" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c35caf9bcb3f6f490bfde00b0c3968922c948d5a2ca637aa7ab027fdc5de98df" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="83013de86948bac18a7bc007e656261d8bd984747db22e59774736777383b1f5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="3d96880e305524eab23bf121b65744b2eed11202febddc85482248b831e1ae71" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7874859d99e0824523e8d58e55574183b924c058591ca584490c2baeb01cc893" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="60456ba93f333cd868a72e31ca65a9ffbc389495bcdf25c7186ad47e08cf2ffd" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="0eae9ae8b0453de6f76d626325938f43da051b58ff236c6570f00f7b8c3fe726" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="24515b0b432820dfd45823de76e46adc3ab8d9897040658ef1a593aece695dcb" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ae5c1a696ba543f154398177b802e1c94f2e1ee36a17378a380ecd8cbde0b2e7" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ab8cebb75d5962420dc39eb7f6fa0dee1892b65c192cdcbc15499404e7222c65" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="a99c93738ae033cc52db30662fc190e3b516907a848ee0fb2af25195fa29e00e" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5501254f3f51186e86f59ae8c2e674693adf064062e36a85ae5da9d802dbcac0" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="7a1720c1edf06dd2b2e386bebaa6036882586784f6e4ed14e1f98cede5a210aa" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="108d15ae8932f29e8f525b1ce8ba3db4361a9cc84e1ea30d2520e0d82e5db564" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="dbe1dc7e6c0eb6f77ad476c1c43e60b7e5b30f0167a868cc8379a1d27141e68d" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="ec3e8fc5819afec02382e909ab97af5f842ed23d4acff634c2dbe3d6e82b4b87" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="b049d40bba76bf87f04e17a3a47ec44e52d191c5266812bfc5802ddeb75154cb" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="16c3eb6b431960e0a8d6359c2c716bc6f3e8c6010653d9ccc1d1cc9f77f0061f" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="259c40ef5ee577fb650093051bdbfdec63f635c63826f02fee8c25e091deff1b" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="ebe7787ee3322e65464358fac86977e3987a133c48b2abea0e352e42d5aae80e" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="f3b93089633cd6da6e886774388526278f511c52f83e507ca3216486536b33ca" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.7.3"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="d15beecd3c85e770feaacd93ce2174b210c61b08fca99f790ad457d7cea407ae" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="99bf72a04ac2ebda4fa950a20fe8ebae46367a0d31752c4a5b338b0fc95d1bee" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b5ecb287bd69b4b3360ad2f80aae003259e60af0512ff01fd7499dd6dd0a03e4" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="93aa5ac1a52e19f24b3ba71b58dd8943c504ca19d5ef5aa447745ee753be5c53" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9654f62636b4f189a23539fa922b4f94e96613d002a9f3b5eda6b41f02555cd0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6afa8b6351ea9eaff326e083930d36d37657d4b7482ebfbb45199cc1f5b0631" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2630835d315a24e76c261b2e933bd81b39ed676f891ab12da31c4e4bdfc6494c" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="30c09b77e649df871986dbb8cda014b91a0aa46cb93121d90decf8c053a6ec70" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ee2ac00c6ac376d18558d61ee8baf32de7953904ab01325bcd5e41492da848d0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8f188c7006017d5d08944969185c1e9d2731abe371e4b5d1506d51f658149d89" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b11f1812406af7c636aceab50ad399fa2003db5d395f344bf352d0ceffe78439" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="45defac5bcea273c6299217497dce7ffe33a18ef35d80c28f283712a3841289e" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="bfe28b94c014133a58bda722ec53e720edd10184085dd7efd64c1f5c854ab588" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cbcefa5646e8db123176a6a49d1d888148e5ce13f101d3b3622df4551bd0d580" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b92cbd6da72ac7c317a73c00e440e0ce69cf943a2988c99f8f1f8eded04a719d" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="2f6af57ea5d35fc77a8a464678c07f39792a9787851015f0991b660f1ec94470" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5da541313a499bcacb0fff0b1888376202ba62a5c9618139c02afa4cd2c0a7df" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="010f248eb2b5112b310ad89c198831786c67bec91338b9531e05797e6c931b0d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2a20315555e9d17e8f11a27fa89c9fbb34513a103ae1f89a475abbaac0e63714" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="05001c4042ac43d171c329eff6dc1ac0c9b6e89908b55c6c89f1962ae1ce848e" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5282f9a5470b82897e7af581ea2597b513a16c6d1b1fe362c32f66cfb3cadec0" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d435ccab2f1751d83cef002c33d54ae7d87e1c97a919ffac27850ae132dd380d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5b3844387e2b684c5c8357e85e2b01b7de88a408e996725b92c458ede8f886e0" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b48d7e5de4f85e9db9af309280c9c57caa61d0b0c8c6ee299b9149e6c937e267" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="adab6e390a1ba32c109d01c0cb65b430b907bf7756087ee045a178663f4e0f88" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c0c47fd8df16b269046db33349b43bf4bbe10b3385ed7dcaecba6727d28053d8" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="15aba99ed1588032d7afd4c0e04d6019f042840c1ee3682c61aede8f0b2b24cc" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="fe8e3d969931a3d3d0d9f503725b744aaaa2b8511b619ef156e56e67125c2330" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="36bda4ed9a819db6fda4ee05843dd9a333f4730f356ba379086528c2cc9d305d" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="89e2a3fbb620953cc14ca8db100589940d17c8e4893adb8b1d9a5bc7791c91cb" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8da17828bd0a5c20a2e444685305afe476d727fe8201bb115097144854d36164" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3d2a67b2d0c5b464a33967496287982b4720dd3ceba6c24dde6dbedfd0336867" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="f6c7f3fab73e092d33d910e70a2ccd32bc3b80f56838639573d40cf27fc7da24" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="28ae7a1fa72acabec603188a5ebe18540dd6ffbad63d7c63dc3284607456bc14" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6abb5b586a234de2fcaa26e04421d68df840923955ca5fd09ebfa8d21158fd1" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="229ab73b9dd67a404a425d67f39b6a9afdf197f66ce29f2dd8bb5e56d79c2510" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="a7bfae8478084caa660a51300e8f29f34c1b8517690b6dffba95dbe30d80b8fd" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="c9651c420b743966c9c8ccb7a03a53553b7392ec1d40dc287722071e3db58cdd" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="764a0894a7b577ee9f3659248f0081061d3598804b093723da22c9c31606e788" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="b730553ee8bc61cb24b5a94f34233695f5ef0fc1aedd32fdf7caece6e4d2b0cf" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2bf77889cf9b27c0bb909373ab57e4982115da1297ada1eb42d0eb63640f9b2c" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9e2d280e9d93ad67dff5364a8d819edc57a6fa66ef86073432e1222b92914f33" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.8.2"/>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1726142400">- Add PackageKit-zypp-dont-install-updateCandidateObj.patch:
  zypp: Mark the correct packages to-be-installed (bsc#1227389,
  gh#PackageKit/PackageKit/commit/209aa6295).</changelog>
</package>
<package pkgid="cfde0143f2b5d71dc8a2aa000c2b43107e788a3d475406319517f31839a174c2" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="43eb6fb753bd1990cc1f97c4964928053e1fc1a527de5a44078e979f3f2e6071" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="6a7a910b5bda6f9d5253fc4508b2550a7876f2e8825f2b287a12a95917e790de" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="305642dd8be6d602f7224f94e3283fd6b49a996351df76d89dc0ae99ebf2829d" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="ad0a395c14e26b54b0ccd9e372f7c00c24b9c7606a09ce483c27ab2d402eb83c" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="c31b31fa0453ed8c11df97e3b2e756a396ea1878e24029248893af5f37fd6a22" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="ca3d9d6101f8bb794074384bb1cc5c3019dd2e51811850027c74e3468024026d" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="bdc264a0ab5e3b1734488b90c3b2d520f7ae34d2c216033bffead164d647d6ee" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="d0f1804ce5c643f5638be76e4be4d3a44e9abce91b5b443d94637d1b8f0fd990" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="1f753346aba5ba687bab3e998054eb616eff9e92030bf3d802bd0014fb1f0937" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.4" rel="150000.48.4"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
  <changelog author="abriel@suse.com" date="1738584000">- Version bump to 0.185.4
  * Fix SAPHanaSR-monitor to get and display proper sync state and
    secondary score
    (bsc#1234342)
  * Fix SAPHanaSR-hookHelper by using full pathnames for commands.
    This will fix the failing fencing with hook susChkSrv.
    (bsc#1216918)
  * Fix handling of HANA_CALL timeout return values
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHanaController.7
  * new man pages:
    SAPHanaSR-ScaleOut-scenarios.7</changelog>
</package>
<package pkgid="818065b32870370f7329b41307972efb498fc0f595f2b52cdcfb6268074c0d56" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.10" rel="150500.3.15.2"/>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
  <changelog author="abriel@suse.com" date="1741348800">- Version bump to 1.2.10
  * enhance virtual hostname detection.
    If the saphostagent fails to answer the ListInstances query
    additional use the &lt;sid&gt;adm user environment to get the virtual
    hostname.
    (bsc#1237473)
  * support hostnames containing dashes
    (bsc#1233972)
  * remove use of deprecated command crm_master, use crm_attribute
    with option '--promotion' instead
    With that change use '-INFINITY' instead of the short '-inf'
    for the score
  * try to recover lost transient cluster attributes
  * decline promote/takeover, if remote node is still member of the
    cluster but lost his score value.
    Membership check against pacemaker and not against corosync.
  * SAPHanaSR-hookHelper - on action fence, kill hana first to
    avoid call of the srConnectionStatusChanged event which would
    result on SFAIL in some cases
  * remove legacy tools added accidentally
    These tools were designed to work with our classic resource
    agents implementation and will fail on the new implementation
    using different attributes and logic.
  * new man page:
    SAPHanaSR-showAttr_properties.5
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    SAPHanaSR-alert-fencing.8
    SAPHanaSR-hookHelper.8
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susTkOver.py.7
    susChkSrv.py.7
    SAPHanaSR-showAttr.8</changelog>
</package>
<package pkgid="ec2793270e0b3162d1d696ae3f56910c557c69b8465651ee37fc8efffb7433ee" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.10" rel="150500.3.15.2"/>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
  <changelog author="abriel@suse.com" date="1741348800">- Version bump to 1.2.10
  * enhance virtual hostname detection.
    If the saphostagent fails to answer the ListInstances query
    additional use the &lt;sid&gt;adm user environment to get the virtual
    hostname.
    (bsc#1237473)
  * support hostnames containing dashes
    (bsc#1233972)
  * remove use of deprecated command crm_master, use crm_attribute
    with option '--promotion' instead
    With that change use '-INFINITY' instead of the short '-inf'
    for the score
  * try to recover lost transient cluster attributes
  * decline promote/takeover, if remote node is still member of the
    cluster but lost his score value.
    Membership check against pacemaker and not against corosync.
  * SAPHanaSR-hookHelper - on action fence, kill hana first to
    avoid call of the srConnectionStatusChanged event which would
    result on SFAIL in some cases
  * remove legacy tools added accidentally
    These tools were designed to work with our classic resource
    agents implementation and will fail on the new implementation
    using different attributes and logic.
  * new man page:
    SAPHanaSR-showAttr_properties.5
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR_upgrade_to_angi.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    SAPHanaSR-alert-fencing.8
    SAPHanaSR-hookHelper.8
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susTkOver.py.7
    susChkSrv.py.7
    SAPHanaSR-showAttr.8</changelog>
</package>
<package pkgid="43d7e0b632411e6e0bfe04ed9cb80055d4c03d61981f6b66ad27f7fd879c3a6e" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="018c692ad22e0691d93dad0b46e98b28ff901c4059e1f6f8395dc9039dd490e2" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="802afcce56204075ebe63de3faee067c32a55a1742d6e61330b317bd518099f6" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="8df139a961d0cb77202418f3713d0cdc22507a405338a176a62c97cdf5835876" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.9" rel="150500.3.12.2"/>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
    (jsc#PED-6403)
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
    (jsc#SAPSOL-133)
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
  <changelog author="abriel@suse.com" date="1730894400">- Version bump to 1.2.9
  * add SAPHanaSR-alert-fencing, an alert agent for cluster fencing
    alerts.
  * enhance SAPHanaController with the feature ON_FAIL_ACTION=fence
    This is part of the 'FAST-STOP' feature of the resource agents.
    (jsc#SAPSOL-196)
  * Improve handling of timeout return values for the resource
    agents
  * SAPHanaSR-showAttr - adding new option 'sitelist' and new
    output format 'csv' and 'cache'
  * new man page:
    SAPHanaSR-angi-scenarios.7
    SAPHanaSR-alert-fencing.8
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaController-scale-up.7
    SAPHanaController-scale-out.7
    SAPHanaTopology.7
    SAPHanaFilesystem.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    SAPHanaSR-showAttr.8
- add additional requires for SLE16
  /usr/bin/sudo and /usr/bin/logger</changelog>
</package>
<package pkgid="56796144e77787eaec40627a45b56338fc3f2ede6f97eb98d38683f8cf49d043" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="79bafe4cce351957a6c6b1f6c9e9752e923092dfe5645d6f55084f38f89ca964" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.5" rel="150000.4.47.1"/>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
  <changelog author="abriel@suse.com" date="1748865600">- Version bump to 0.162.5
  * SAPHanaSRTools.pm: fix problem with new pacemaker-node_state
    attribute content to show the correct node state in
    SAPHanaSR-monitor.
    (bsc#1243447, bsc#1243723)
  * enhance observability of the RAs and update version string
  * SAPHanaSR-hookHelper - use full path to call crm_node
    (bsc#1216918)
  * demo script SAPHanaSR-upgrade-to-angi-demo:
    fix check for package SAPHanaSR-angi available in the active
    repositories
    fix removal of the classic rpms
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7
    susChkSrv.py.7
    susCostOpt.py.7
    ocf_suse_SAPHana.7</changelog>
</package>
<package pkgid="4212f14fa45ee3e11e352de344fc01d09ef6937824cacf6ced8d354fdc28a2f3" name="ServiceReport" arch="noarch">
  <version epoch="0" ver="2.2.4+git7.8ca0fe4" rel="150600.3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699358400">- Fix build with RPM 4.19: unnumbered patches are no longer
  supported.</changelog>
  <changelog author="msuchanek@suse.com" date="1709035200">- Update to version 2.2.4 (bsc#1220410 ltc#204408)
  * ServiceReport v2.2.4 release
  * [kdump] update /etc/sysconfig/kdump config processing
  * [kdump] customize initrd dump component check for SLES
  * [fadump] update initrd validation check
  * [kdump] restrict lsinitrd command to fetch only modules</changelog>
  <changelog author="msuchanek@suse.de" date="1729684800">- Update to version 2.2.4+git2.f1e4503:
  * [Service] Make the servicereport service dependent on the kdump service
  * [utils] Use --update-bls-cmdline Option for GRUB Update
- Refresh harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1744977600">- Update to version 2.2.4+git5.e48c02c:
  * Added hardening to systemd service
- Drop upstreamed patch harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1750420800">- Update to version 2.2.4+git7.8ca0fe4:
  * [utils] update logic to parse /etc/os-release (bsc#1244547 ltc#213710)
  * Added hardening to systemd service</changelog>
</package>
<package pkgid="72a31ba854da8f456d71987fc8c0d3867171060c4ad659a8c3106ab5bb3c2ef9" name="ServiceReport" arch="src">
  <version epoch="0" ver="2.2.4+git7.8ca0fe4" rel="150600.3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
  <changelog author="msuchanek@suse.com" date="1639483200">- Fix build on SLE 15: python-rpm-macros required for build (bsc#1193718).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699358400">- Fix build with RPM 4.19: unnumbered patches are no longer
  supported.</changelog>
  <changelog author="msuchanek@suse.com" date="1709035200">- Update to version 2.2.4 (bsc#1220410 ltc#204408)
  * ServiceReport v2.2.4 release
  * [kdump] update /etc/sysconfig/kdump config processing
  * [kdump] customize initrd dump component check for SLES
  * [fadump] update initrd validation check
  * [kdump] restrict lsinitrd command to fetch only modules</changelog>
  <changelog author="msuchanek@suse.de" date="1729684800">- Update to version 2.2.4+git2.f1e4503:
  * [Service] Make the servicereport service dependent on the kdump service
  * [utils] Use --update-bls-cmdline Option for GRUB Update
- Refresh harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1744977600">- Update to version 2.2.4+git5.e48c02c:
  * Added hardening to systemd service
- Drop upstreamed patch harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1750420800">- Update to version 2.2.4+git7.8ca0fe4:
  * [utils] update logic to parse /etc/os-release (bsc#1244547 ltc#213710)
  * Added hardening to systemd service</changelog>
</package>
<package pkgid="ac74198ca85ea27504297d47ef0cc9076f2ed5b0c70ad26eb330a8e55612fcb0" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="cd65cabda6c6d064e57735912506836619ed033d1c8b0d615281dafda4d0513a" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="51bfdd91c4dbe130fcd2abf23a5d91ca58871ecfd7f583b6eea4d2f4eb8ddfd4" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="f402fb459061e9c6f49e6a9d8e9fce54453b3d35f68fd5750413eb420562ae44" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="2a46b59e7898c652fd86b44286d09e47dcfb37cc52bbdb2424e0aa544a3d8791" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="f6641ecd3f79b17823293b1929934167977c36d36f083f35cb7adaa34ad4a994" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="21f8a6c54991e6c2395106dcdff13457cb1188b3ecf9d8279646f3e7a3f0b695" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="4af9c06f3caa725a3687c6046e5ce9f2e8ffeab3d05b68423d2638775dcad276" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="924bb3fef4ef8497dc9fc61bfe2c967027adbb354195630ea8aa09b57b4d8fe3" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="44cf0c5913c02d7045dcc54fc4773b8af8533822128bf518333ad0c3abb094b6" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="3bcb1b7a21225183e5f96905ba2f361b0014f29e5a72fcec9d1cf8a4cf8c2c55" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="22410e2cb9899cb095e04792447136c2987ef9d8961433316be916bb386b81fb" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="66357789d77c102e20d261f724e311304ee86c8bffd6820b3140d2114debb37f" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="2218e37ef2e90042f169d97d09d1079baed15e059599919c124a57e5c41ba3df" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="3ae29990e655778908f431d27d8d0cf897f9ef8d7d400a8f7ad85cb021b137dd" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="b6f285b9f078955078877649a26c60aec4bc32e85bd8859046c95b092dc69f89" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="f1b7395bae575912beefb4c287368343ec686678b850895c3943c74dd2012a07" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="74f69a31251856a6265bfaabafc6cb867f62bb34abedcf1f3131028d826adeb0" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="110945b61f900e4f221fbbe914f7eeec7e7379ecc85667e1960006156c4c39e6" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="2b0203b1b8666f74015ee22c1f9e8dc3e15c294f813b12ed89cf94a0fd4dee84" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="71aff0208f8e1de04635e03bddcaba2a1e9360d4ccde6dbe96cbd82c555ca1b6" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="999229b2a65607abda54e9303c1b130af43619a50fcdcf7c80b310b1d8ef2928" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="24faf76f63666b5f78285245064da99c6a653abbf5a75573a58197d6512c1620" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="4fad5119ab93cb7e3d5e604f26eaab3437e631085bd814110601d5ae60ac6398" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="677bf4943eca1e2577223e6deba0c46ea7051e153a0b3a0d7347d1d2760b2b7e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="519ac4f28accd5ccf971952f4e91b3074a3efe3a8b6e781ed031a0094c4c1a88" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="2ea4c2dffe3ecf4ef13365f4136f83dc0b38749c6bc643298c61c20c7e9b4cc6" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="7ebc92874f171f5a47e926f02b5ef3b0fdd6bd408003aeb461aa80742f3f260c" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.0" rel="150600.12.12.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
</package>
<package pkgid="3cc150d1107dc946ce95436bf3a8040939e1dbc5f215d7cac3e7904f476766cc" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.16.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558, CVE-2024-27838, CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
</package>
<package pkgid="7312685c5425dc1fd9356785f3538a08bda7bba983535cb0975887d091b7d8f7" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.3" rel="150600.12.21.1"/>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
</package>
<package pkgid="751350f8e550e426a311865d9dae4402513c941371aa3ace80c5e4484b6acc8a" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.5" rel="150600.12.24.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54508, CVE-2024-54534.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
</package>
<package pkgid="50197db537a413867a295a106284b05d546c432a3b69a4e511d2026e7de3095e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.27.1"/>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
</package>
<package pkgid="1b78656f8dfdb2b5b85776c7c80aa1f9bc820009387f71af9936f682fa82b971" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.46.6" rel="150600.12.30.2"/>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
</package>
<package pkgid="d2d446e580988df05ed7778dd86e3565bc83d2c2180da61ca1a20af8284a92d1" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.0" rel="150600.12.33.1"/>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
</package>
<package pkgid="5f1f96c88c301ece2681855fa865d0a08940ab4bd8b2c19c95cdaa9cb1bf7fdf" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.1" rel="150600.12.36.5"/>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
</package>
<package pkgid="ab2133c248e0b85dae05b3b362926d8b4a632c9cc6a0ee8b9f192dc7ce34292d" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.48.2" rel="150600.12.40.2"/>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213,
    CVE-2024-23271.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834, CVE-2024-27808, CVE-2024-27820,
    CVE-2024-27833.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843, CVE-2024-54658.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228697):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2024-40782, CVE-2024-40789, CVE-2024-4558, CVE-2024-27838,
  CVE-2024-27851.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
  <changelog author="mgorse@suse.com" date="1729166400">- Update to version 2.46.0 (boo#1231039):
  + Use Skia instead of cairo for 2D rendering and enable GPU
    rendering by default.
  + Enable offscreen canvas by default.
  + Add support for system tracing with Sysprof.
  + Implement printing using the Print portal.
  + Add new API to load settings from a config file.
  + Add a new setting to enable or disable the 2D canvas
    acceleration (enabled by default).
  + Undeprecate console messages API and make it available in 6.0
    API.
  + Security fixes: CVE-2024-40866, CVE-2024-44187, CVE-2024-44185,
    CVE-2024-54534, CVE-2024-27856.
- Drop webkit2gtk3-disable-dmabuf-nvidia.patch: Should not be
  needed anymore.
- Add webkit2gtk3-angle-s390x.patch: fix the build on s390x.
- Use gcc 13 to match what is tested upstream.
- Pass USE_SYSTEM_SYSPROF_CAPTURE=NO to cmake, avoid building
  sysprof capture for now.
- Add bug281495.patch: fix crash in ProcessLauncher socket
  monitor callback.</changelog>
  <changelog author="mgorse@suse.com" date="1730721600">- Update to version 2.46.3 (boo#1232747):
  + Flatten layers to a plane when preseve-3d style is set.
  + Fix DuckDuckGo links by adding a user agent quirk.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44244, CVE-2024-44296.
  + Changes in version 2.46.2:
  + Own well-known bus name on a11y bus.
  + Improve memory consumption when putImageData is used repeatedly
    on accelerated canvas.
  + Disable cached web process suspension for now to prevent leaks.
  + Improve text kerning with different combinations of antialias
    and hinting settings.
  + Destroy all network sessions on process exit.
  + Fix visible rectangle calculation when there are animations.
  + Fix the build with ENABLE_NOTIFICATIONS=OFF.
  + Fix the build with ENABLE_FULLSCREEN_API=OFF.
  + Fix the build with ENABLE_WEB_AUDIO=OFF.
  + Fix the build on ppc64le.
  + Changes in version 2.46.1:
  + Fix login QR code not shown in WhatsApp web.
  + Disable PSON by default again in GTK 3 API versions.
  + Disable DMABuf video sink by default to prevent file descriptor
    leaks.
  + Fix the build with GCC 13.
- Drop bug281495.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1732536000">- Add webkit2gtk3-CVE-2024-44308.patch: don't allocate DFG register
  after a slow path (boo#1233631 CVE-2024-44308).
- Add webkit2gtk3-CVE-2024-44309.patch: fix a cookie management
  issue (boo#1233632 CVE-2024-44309).</changelog>
  <changelog author="mgorse@suse.com" date="1735300800">- Update to version 2.46.5 (boo#1234851):
  + Fix the build with GBM and release logs disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-54479, CVE-2024-54502, CVE-2024-54505,
    CVE-2024-54508, CVE-2024-54543.
  + Changes in version 2.46.4:
  + Improve memory consumption and performance of Canvas
    getImageData.
  + Fix preserve-3D intersection rendering.
  + Fix video dimensions since GStreamer 1.24.9.
  + Fix the HTTP-based remote Web Inspector not loading in
    Chromium.
  + Fix content filters not working on about:blank iframes.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-44308, CVE-2024-44309.
- Drop webkit2gtk3-CVE-2024-44308.patch and
  webkit2gtk3-CVE-2024-44309.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1739188800">- Update to version 2.46.6 (boo#1236946):
  + Fix a crash when enabling Skia CPU rendering.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24143, CVE-2025-24150, CVE-2025-24158,
    CVE-2025-24162.</changelog>
  <changelog author="mgorse@suse.com" date="1741953600">- Add 7d784721.patch: WebGL context primitive restart can be
  toggled from WebContent process (boo#1239547 CVE-2025-24201).</changelog>
  <changelog author="mgorse@suse.com" date="1743508800">- Update to version 2.48.0 (boo#1239863 boo#1239864):
  + Move tiles rendering to worker threads when rendering with the
    GPU.
  + Fix preserve-3D intersection rendering.
  + Added new function for creating Promise objects to
    JavaScripotCore GLib API.
  + The MediaRecorder backend gained WebM support (requires at
    least GStreamer 1.24.9) and audio bitrate configuration
    support.
  + Fix invalid DPI-aware font size conversion.
  + Bring back support for OpenType-SVG fonts using Skia SVG
    module.
  + Add metadata (title and creation/modification date) to the PDF
    document generated for printing.
  + Propagate the font’s computed locale to HarfBuzz.
  + The GPU process build is now enabled for WebGL, but the web
    process is still used by default. The runtime flag
    UseGPUProcessForWebGL can be used to use the GPU process for
    WebGL.
  + Security fixes: CVE-2024-44192, CVE-2024-54467, CVE-2025-24201.
- Drop 7d784721.patch: Fixed upstream.
- Disable speech synthesis. It has been disabled until now, and
  we don't have flite or spiel in SLE.
- Add gcc13-PIE to BuildRequires (bsc#1239950).
- Add webkit2gtk3-iochannel-network-cache.patch: backport upstream
  patch to stop using IOChannel in NetworkCache: hopefully fixes
  crashes in the network process.</changelog>
  <changelog author="mgorse@suse.com" date="1744113600">- Update to version 2.48.1 (boo#1240958 boo#1240961 boo#1240962
  boo#1240963 boo#1240964 boo#1240986 boo#1240987):
  + Limit the data stored in session state.
  + Remove the empty area below the title bar in Web Inspector when
    not docked.
  + Fix the build with GST_DISABLE_GST_DEBUG.
  + Fix the build with GStreamer &lt; 1.20.
  + Fix the build with video disabled.
  + Fix the build with clang 20.
  + Security fixes: CVE-2024-54551, CVE-2025-24208, CVE-2025-24209,
    CVE-2025-24213, CVE-2025-24216, CVE-2025-24264, CVE-2025-30427.
- Add 8bee9eb9.patch: fix the build on non-x86 architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1747828800">- Update to version 2.48.2 (boo#1243282 boo#1243286 boo#1243288
  boo#1243289 boo#1243424 boo#1243596):
  + Enable CSS Overscroll Behavior by default.
  + Change threaded rendering implementation to use Skia API
    instead of WebCore display list that is not thread safe.
  + Fix rendering when device scale factor change comes before the
    web view geometry update.
  + Fix network process crash on exit.
  + Fix the build with ENABLE_RESOURCE_USAGE=OFF.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2025-24223, CVE-2025-31204, CVE-2025-31205,
    CVE-2025-31206, CVE-2025-31215, CVE-2025-31257.
- Drop 8bee9eb9.patch: fixed upstream.</changelog>
</package>
<package pkgid="bd9492cd906dbf1d084580582422926baf8bd3659d4e347b8808635a03439891" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b0535694a32366f93830f23822c77f7744792780621a2e8bb701ac6e9e770a6c" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="9338bc325b60e59b7a48492a7ffd6e7e302ba111ed0ee369bd67e9c4fb6c488f" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="862585b96b291271b7c68f130ab3ab75afc51eac570e5afff94270572a767130" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="520a1a79da52c509673b5dff77405c93ff366e30912447d842d78c4a46fb3007" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="cc0a564104b1d93aff9b72f24c88175f500b5b3b4385e84dcc66e693a419c1a0" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="2245fa71807300a2153cddf948bceea291c7047d35bcb767e1fe037195cbe1c5" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="e65a213fd3e276ff937ec6e445dceaa8d400f038a51bb2b5d9dce4dca65c4814" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="c3d59ea176e6b9d7d3c8ea3902cbb173c9c27d3a9b6c3d8e8ea70648276fc5b4" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="4dc19ec312ad01256d8abcc29ce141139c5a891f655e7d8fe6d181483f7fdcea" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="070c842c8cde74cf28dd8c61d358b633747bff5ce3bed40ef2696ebc89ed0e30" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="c6b63b1bd6efab7435331cae00dee3b418a055fcfda823863f51c974fb144abc" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="3f606a46fbaa478c7076609120bc96fac6ea514bf0a893b2720f1fb9590d8f91" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="d4f547c6364af57c28cc4fd54e5c1c966caad02c01ad088146fc38fec85b976a" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="7c228e324149bf049d7e17485e291f843767c743fbe93e0311c447f1d5712778" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="a02632e83d4aabbbda31919d1eab94df6857a3a1256c23312bbbee119897fa53" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="0db0504c8c2911422db2fbcbfbd5d4958c333e4b2b85d30e315354d3ad425efd" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="d817c2abee0c17c40110a0d91731452b21c9191aaadaaeff8228ec14362ef531" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="e0ea28605bac277e348893eb71276b605568a6816e49a46e7ad11e2d9829ee6c" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="c76ea85bd6311824975b3c4cb1c2aa25eb073dabfb00bb13366805ca479136db" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="728fd6c12225eb329552425b6d258ef669470069654f39ae1164672615abe813" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="d0286fecce1ac873cf6267fa530239090b0387f916f1ab95b4501946ebd48927" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="e7b307e26aac6c348983703eb372f994d2be7d4e912028d8ac6267c48b91f906" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="528b8cad255e029ff3dc929bf6c027a54f9b49a5e0b1e334752d36b5a66e5690" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="4c5954696a307b329bfd4b5ae1af280eb973e0ee583cbf70a00218e099e3a919" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="9f810f876489d442210830a9a562a51ee04a1111aeeb17d51524d821dc060578" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="c8a075856bfe615e067f7a9039c72d09523dab3249eb5c0f759645bc95d29e3a" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="ec21a45a7bcb9cf8f1eb14ec5732dde579d52bd1fd22178fe0bd7bc8f15d540b" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="534987043fe1e7f9d970edf0c77d39fe0ca252961ef11db407b5c2389d7cd644" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="80a97f41c2c270de1f21bbb60939a4af12524cc25bc006b49fdab7af02a43809" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="4703a2799fe2f72fae2383fb53f566de046649061b60852c8610a2330d91a163" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b25322920a733a10ff0d401df951307ad9c1c116922270a03a871a07516d023f" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="72fc2a2cb764313026094059399139fcbdcdacc99afb82ce88db3c26dfb51d56" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="530b3a05436b911f4d8edfc411014904e84fa59d422aaa8c75279ecb1a0efba1" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="24773bbf44a07db15a6ad2c5a7ef13f6fa2b962c3c033de25f363f5bd1b20b38" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="d1516db810c54e2f5d1e3533e783388bb0034018a8f0b27ca962fc6134ad75db" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="caf305dce8586d078c718e4cd6ff891cc01d603a8de11310f3f79b6fbf78137e" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="0f0ddf890f4bfc12a9a478e6cda712ac2870815ec170973f8604d683b87eb0a1" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="6b491ab87ad1cf3b6bb86f7571331feb1641042e674615e087d4850630f98901" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="45764b49fe8a507fee4731946d4fec905e44f6293ed0b390f7f714d603374e31" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="11f91458b43459142414113a87e3e313265cdf0ebad4e0685efe536d3f494ef9" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="424150c0321234070da1bf198a144ae983b2f56b63a8230beb1ad8d334a61f07" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b2542ad8fff7527a59c661537f3c76983058a0d4b4a564d389df2ae1d2efe188" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="2933cbb7f76ec18a1f163ad3915a440d7c7dd21bb0a76d7cb230eec0bb97df62" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="eb9703dabff90c17d130c55969bd10c73ed1a4bfe2e409cdada5e73f61be268c" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="65eaebf042553b69f79405993362dc8d260333b7cd9d0931440b1a6f5dc6d061" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="1831d96a2394f3d13422ee2e68023c8575312492b92b8b9f786a0cd32e9d2566" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.23.1"/>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
</package>
<package pkgid="86cd8a9c83eab8a0cbecf55eb4d89b0e54f13d3be451a12d9c7162bf9e979bc7" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="b8ec920b0262c42b34baa505263cd81402c7497f585ed0e43975550e3a4c79c5" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="58e9a513167bd2e03abb8544b79fad492929aca0cd073a478594f1d3b1e2088e" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="3ac15fcf47f3a26213402ca3b1d8255e30e2f2cc318dd96894941b87bd48ab1e" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.28.2"/>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
  <changelog author="werner@suse.de" date="1731326400">- Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch
  * Add mc helpers for both tcsh and bash resources (boo#1203617)</changelog>
  <changelog author="ro@suse.de" date="1741694400">- add patch aaa_base-rc.status.patch (bsc#1236033)
  (no git, file is gone in factory/tumbleweed)
  update detection for systemd in rc.status, mountpoint for
  cgroup changed with cgroup2, so just check if pid 1 is systemd</changelog>
  <changelog author="werner@suse.de" date="1742299200">- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
  * If a user switches the login shell respect the already set
    PATH environment (bsc#1235481)</changelog>
</package>
<package pkgid="02cefa13a9c016190a4b2da88da1ea59d5c045fc52e5f2e79190a03fabbf2837" name="aardvark-dns" arch="aarch64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="f88306473701582ef4a5ec91a887f49239797094cb2b804a711733b55779b65f" name="aardvark-dns" arch="ppc64le">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="a97d1de58e126323a2070b3231acf54d9cdfc381c5877bc30fd644c1c96fe605" name="aardvark-dns" arch="s390x">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="499610eb025fcb432bdd554fad706335c12167a736122dac7ed2e34339e46ba0" name="aardvark-dns" arch="src">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="10b88f9f5ec5363ee8d4399db52288a1e432298bb6b121223217bc7ad57fb076" name="aardvark-dns" arch="x86_64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="125aabec8316f247dd940d89205bfff1c8b9908ef1ce34440b207e6276162bec" name="aardvark-dns" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="150500.3.9.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1739361600">- Update to version 1.12.2:
  * Release v1.12.2
  * Update release notes for 1.12.2
  * coredns: work on tcp requests concurrently
  * tcp: add timeout to connection
  * cirrus: update branch names
  * Release v1.12.1
  * Updated release notes for 1.12.1
  * Change av cargo categories
  * Bump to 1.13.0-dev
  * Release 1.12.0
  * Release notes for 1.12
  * config: ignore enoent errors while reading configs
  * run cargo update
  * update upsteam resolvers on each refresh
  * fix(deps): update rust crate syslog to v7
  * fix(deps): update rust crate tokio to 1.39.2
  * add tcp support for forwarding (bsc#1234660)
  * add tcp listening support
  * test: add new test to check for startup error
  * return bind error to caller on first start
  * add our own error type and use it over anyhow
  * server: use anyhow to wrap parse_configs error
  * server: split out main loop into new function
  * main: remove aardvark-dns error prefix
  * coredns: remove unnecessary try_join! call
  * coredns: drop pointless name var
  * serve: read nameservers once
  * replace signal-hook with tokio::signal
  * serve: fix broken error logging
  * server: improve parent &lt;-&gt; child error handling
  * add some basic perf check script
  * fix(deps): update rust crate tokio to 1.39.0
  * coredns: create reply_ip() function
  * coredns: match dns type explicitly
  * server: use only one tokio runtime
  * coredns: improve indentation for process_message()
  * coredns: move upstream resolvers detection later
  * coredns: do not clone sender
  * read AARDVARK_NO_PROXY once
  * coredns: move main code out of select!
  * coredns: fix "name" naming
  * coredns: remove unused forward_addr/port
  * coredns: fix handling of dns search domain
  * coredns: rework PTR lookup flow
  * fix(deps): update rust crate tokio to 1.38.1
  * [skip-ci] TMT: Reorg upstream tests for downstream reusability
  * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
  * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
  * fix(deps): update rust crate log to 0.4.22
  * [CI:BUILD] rpm: Update Rust macro usage
  * fix(deps): update rust crate tokio to 1.38.0
  * Bump to 1.12.0-dev</changelog>
</package>
<package pkgid="5080e72ac8db1aae830deb58a303cbe8080128d55f029af5d9ae5a9efb5ad62e" name="aardvark-dns" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="150500.3.9.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1739361600">- Update to version 1.12.2:
  * Release v1.12.2
  * Update release notes for 1.12.2
  * coredns: work on tcp requests concurrently
  * tcp: add timeout to connection
  * cirrus: update branch names
  * Release v1.12.1
  * Updated release notes for 1.12.1
  * Change av cargo categories
  * Bump to 1.13.0-dev
  * Release 1.12.0
  * Release notes for 1.12
  * config: ignore enoent errors while reading configs
  * run cargo update
  * update upsteam resolvers on each refresh
  * fix(deps): update rust crate syslog to v7
  * fix(deps): update rust crate tokio to 1.39.2
  * add tcp support for forwarding (bsc#1234660)
  * add tcp listening support
  * test: add new test to check for startup error
  * return bind error to caller on first start
  * add our own error type and use it over anyhow
  * server: use anyhow to wrap parse_configs error
  * server: split out main loop into new function
  * main: remove aardvark-dns error prefix
  * coredns: remove unnecessary try_join! call
  * coredns: drop pointless name var
  * serve: read nameservers once
  * replace signal-hook with tokio::signal
  * serve: fix broken error logging
  * server: improve parent &lt;-&gt; child error handling
  * add some basic perf check script
  * fix(deps): update rust crate tokio to 1.39.0
  * coredns: create reply_ip() function
  * coredns: match dns type explicitly
  * server: use only one tokio runtime
  * coredns: improve indentation for process_message()
  * coredns: move upstream resolvers detection later
  * coredns: do not clone sender
  * read AARDVARK_NO_PROXY once
  * coredns: move main code out of select!
  * coredns: fix "name" naming
  * coredns: remove unused forward_addr/port
  * coredns: fix handling of dns search domain
  * coredns: rework PTR lookup flow
  * fix(deps): update rust crate tokio to 1.38.1
  * [skip-ci] TMT: Reorg upstream tests for downstream reusability
  * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
  * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
  * fix(deps): update rust crate log to 0.4.22
  * [CI:BUILD] rpm: Update Rust macro usage
  * fix(deps): update rust crate tokio to 1.38.0
  * Bump to 1.12.0-dev</changelog>
</package>
<package pkgid="f1768127e96016d2cb57ad47a0c6fc5f290435be12db334ec582f57bf268a124" name="aardvark-dns" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="150500.3.9.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1739361600">- Update to version 1.12.2:
  * Release v1.12.2
  * Update release notes for 1.12.2
  * coredns: work on tcp requests concurrently
  * tcp: add timeout to connection
  * cirrus: update branch names
  * Release v1.12.1
  * Updated release notes for 1.12.1
  * Change av cargo categories
  * Bump to 1.13.0-dev
  * Release 1.12.0
  * Release notes for 1.12
  * config: ignore enoent errors while reading configs
  * run cargo update
  * update upsteam resolvers on each refresh
  * fix(deps): update rust crate syslog to v7
  * fix(deps): update rust crate tokio to 1.39.2
  * add tcp support for forwarding (bsc#1234660)
  * add tcp listening support
  * test: add new test to check for startup error
  * return bind error to caller on first start
  * add our own error type and use it over anyhow
  * server: use anyhow to wrap parse_configs error
  * server: split out main loop into new function
  * main: remove aardvark-dns error prefix
  * coredns: remove unnecessary try_join! call
  * coredns: drop pointless name var
  * serve: read nameservers once
  * replace signal-hook with tokio::signal
  * serve: fix broken error logging
  * server: improve parent &lt;-&gt; child error handling
  * add some basic perf check script
  * fix(deps): update rust crate tokio to 1.39.0
  * coredns: create reply_ip() function
  * coredns: match dns type explicitly
  * server: use only one tokio runtime
  * coredns: improve indentation for process_message()
  * coredns: move upstream resolvers detection later
  * coredns: do not clone sender
  * read AARDVARK_NO_PROXY once
  * coredns: move main code out of select!
  * coredns: fix "name" naming
  * coredns: remove unused forward_addr/port
  * coredns: fix handling of dns search domain
  * coredns: rework PTR lookup flow
  * fix(deps): update rust crate tokio to 1.38.1
  * [skip-ci] TMT: Reorg upstream tests for downstream reusability
  * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
  * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
  * fix(deps): update rust crate log to 0.4.22
  * [CI:BUILD] rpm: Update Rust macro usage
  * fix(deps): update rust crate tokio to 1.38.0
  * Bump to 1.12.0-dev</changelog>
</package>
<package pkgid="cd0f458754fa87cb028a28864150f2d89e158b79a860aa9bffbc578bcd3c649e" name="aardvark-dns" arch="src">
  <version epoch="0" ver="1.12.2" rel="150500.3.9.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1739361600">- Update to version 1.12.2:
  * Release v1.12.2
  * Update release notes for 1.12.2
  * coredns: work on tcp requests concurrently
  * tcp: add timeout to connection
  * cirrus: update branch names
  * Release v1.12.1
  * Updated release notes for 1.12.1
  * Change av cargo categories
  * Bump to 1.13.0-dev
  * Release 1.12.0
  * Release notes for 1.12
  * config: ignore enoent errors while reading configs
  * run cargo update
  * update upsteam resolvers on each refresh
  * fix(deps): update rust crate syslog to v7
  * fix(deps): update rust crate tokio to 1.39.2
  * add tcp support for forwarding (bsc#1234660)
  * add tcp listening support
  * test: add new test to check for startup error
  * return bind error to caller on first start
  * add our own error type and use it over anyhow
  * server: use anyhow to wrap parse_configs error
  * server: split out main loop into new function
  * main: remove aardvark-dns error prefix
  * coredns: remove unnecessary try_join! call
  * coredns: drop pointless name var
  * serve: read nameservers once
  * replace signal-hook with tokio::signal
  * serve: fix broken error logging
  * server: improve parent &lt;-&gt; child error handling
  * add some basic perf check script
  * fix(deps): update rust crate tokio to 1.39.0
  * coredns: create reply_ip() function
  * coredns: match dns type explicitly
  * server: use only one tokio runtime
  * coredns: improve indentation for process_message()
  * coredns: move upstream resolvers detection later
  * coredns: do not clone sender
  * read AARDVARK_NO_PROXY once
  * coredns: move main code out of select!
  * coredns: fix "name" naming
  * coredns: remove unused forward_addr/port
  * coredns: fix handling of dns search domain
  * coredns: rework PTR lookup flow
  * fix(deps): update rust crate tokio to 1.38.1
  * [skip-ci] TMT: Reorg upstream tests for downstream reusability
  * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
  * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
  * fix(deps): update rust crate log to 0.4.22
  * [CI:BUILD] rpm: Update Rust macro usage
  * fix(deps): update rust crate tokio to 1.38.0
  * Bump to 1.12.0-dev</changelog>
</package>
<package pkgid="575a6d15c4a7de67093a653bb8816637a0ab1ba10a4518dc30758a668a6f5062" name="aardvark-dns" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="150500.3.9.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1739361600">- Update to version 1.12.2:
  * Release v1.12.2
  * Update release notes for 1.12.2
  * coredns: work on tcp requests concurrently
  * tcp: add timeout to connection
  * cirrus: update branch names
  * Release v1.12.1
  * Updated release notes for 1.12.1
  * Change av cargo categories
  * Bump to 1.13.0-dev
  * Release 1.12.0
  * Release notes for 1.12
  * config: ignore enoent errors while reading configs
  * run cargo update
  * update upsteam resolvers on each refresh
  * fix(deps): update rust crate syslog to v7
  * fix(deps): update rust crate tokio to 1.39.2
  * add tcp support for forwarding (bsc#1234660)
  * add tcp listening support
  * test: add new test to check for startup error
  * return bind error to caller on first start
  * add our own error type and use it over anyhow
  * server: use anyhow to wrap parse_configs error
  * server: split out main loop into new function
  * main: remove aardvark-dns error prefix
  * coredns: remove unnecessary try_join! call
  * coredns: drop pointless name var
  * serve: read nameservers once
  * replace signal-hook with tokio::signal
  * serve: fix broken error logging
  * server: improve parent &lt;-&gt; child error handling
  * add some basic perf check script
  * fix(deps): update rust crate tokio to 1.39.0
  * coredns: create reply_ip() function
  * coredns: match dns type explicitly
  * server: use only one tokio runtime
  * coredns: improve indentation for process_message()
  * coredns: move upstream resolvers detection later
  * coredns: do not clone sender
  * read AARDVARK_NO_PROXY once
  * coredns: move main code out of select!
  * coredns: fix "name" naming
  * coredns: remove unused forward_addr/port
  * coredns: fix handling of dns search domain
  * coredns: rework PTR lookup flow
  * fix(deps): update rust crate tokio to 1.38.1
  * [skip-ci] TMT: Reorg upstream tests for downstream reusability
  * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
  * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
  * fix(deps): update rust crate log to 0.4.22
  * [CI:BUILD] rpm: Update Rust macro usage
  * fix(deps): update rust crate tokio to 1.38.0
  * Bump to 1.12.0-dev</changelog>
</package>
<package pkgid="23160ac5492ee4ab4c0d228c3c83a2cfdfa0d2139100fe5cd02946c038118b14" name="abseil-cpp" arch="src">
  <version epoch="0" ver="20240116.3" rel="150600.19.3.15"/>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="jengelh@inai.de" date="1649073600">- Implement shlib packaging policy</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1656504000">- Add options-old.patch, options-cxx17.patch (boo#1203378)
  * Ensure ABI stability regardless of compiler settings per instruction in the header.</changelog>
  <changelog author="fvogt@suse.com" date="1656504001">- Remove obsolete 0%{suse_version} &lt; 1500 conditions</changelog>
  <changelog author="elimat@opensuse.org" date="1656849600">- Update to version 20220623.0
  What's New:
  * Added absl::AnyInvocable, a move-only function type.
  * Added absl::CordBuffer, a type for buffering data for eventual inclusion an
    absl::Cord, which is useful for writing zero-copy code.
  * Added support for command-line flags of type absl::optional&lt;T&gt;.
  Breaking Changes:
  * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control
    whether or not unit tests are built.
  * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that
    are experiencing new warnings can use -Wno-deprecated-declatations silence
  the warnings or use -Wno-error=deprecated-declarations to see warnings but
  not fail the build.
  * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some
    compilers are more strict about where this keyword must appear compared to
  the pre-C++20 implementation.
  * Bazel builds now depend on the bazelbuild/bazel-skylib repository.
    See Abseil's WORKSPACE file for an example of how to add this dependency.
  Other:
  * This will be the last release to support C++11. Future releases will require at least C++14.
- run spec-cleaner</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1657540800">- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
  <changelog author="dmueller@suse.com" date="1664020800">- update to 20220623.1:
  * minor warning fix</changelog>
  <changelog author="adrian@suse.de" date="1682337600">- update to 20230125.2
  What's New:
    The Abseil logging library has been released. This library
    provides facilities for writing short text messages about the
    status of a program to stderr, disk files, or other sinks
    (via an extension API). See the logging library documentation
    for more information.
    An extension point, AbslStringify(), allows user-defined types
    to seamlessly work with Abseil's string formatting functions
    like absl::StrCat() and absl::StrFormat().
    A library for computing CRC32C checksums has been added.
    Floating-point parsing now uses the Eisel-Lemire algorithm,
    which provides a significant speed improvement.
    The flags library now provides suggestions for the closest
    flag(s) in the case of misspelled flags.
    Using CMake to install Abseil now makes the installed artifacts
    (in particular absl/base/options.h) reflect the compiled ABI.
  Breaking Changes:
    Abseil now requires at least C++14 and follows Google's Foundational
    C++ Support Policy. See this table for a list of currently supported
    versions compilers, platforms, and build tools.
    The legacy spellings of the thread annotation macros/functions
    (e.g. GUARDED_BY()) have been removed by default in favor of the
    ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
    other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
    can be defined on the compile command-line to temporarily restore these
    spellings, but this compatibility macro will be removed in the future.
  Known Issues
    The Abseil logging library in this release is not a feature-complete
    replacement for glog yet. VLOG and DFATAL are examples of features
    that have not yet been released.
- obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch</changelog>
  <changelog author="adrian@suse.de" date="1685016000">- update to 20230125.3
  Details can be found on:
    https://github.com/abseil/abseil-cpp/releases/tag/20230125.3</changelog>
  <changelog author="fvogt@suse.com" date="1688040000">- Add baselibs.conf to make protobuf happy. Hopefully temporary.</changelog>
  <changelog author="fstrba@suse.com" date="1691582400">- Fix build on older systems by requiring C++17 compliant compiler
- Added patch:
  * cmake.patch
    + lower the cmake requirement to 3.5 in order to be able to
    build on SLE12SP5</changelog>
  <changelog author="adrian@suse.de" date="1694088000">- update to 20230802.0
  What's New:
  * Added the nullability library for designating the expected
    nullability of pointers. Currently these serve as annotations
    only, but it is expected that compilers will one day be able
    to use these annotations for diagnostic purposes.
  * Added the prefetch library as a portable layer for moving data
    into caches before it is read.
  * Abseil's hash tables now detect many more programming errors
    in debug and sanitizer builds.
  * Abseil's synchronization objects now differentiate absolute
    waits (when passed an absl::Time) from relative waits (when
    passed an absl::Duration) when the underlying platform supports
    differentiating these cases. This only makes a difference when
    system clocks are adjusted.
  * Abseil's flag parsing library includes additional methods that
    make it easier to use when another library also expects to be
    able to parse flags.
  * absl::string_view is now available as a smaller target,
    @com_google_absl//absl/strings:string_view, so that users may
    use this library without depending on the much larger
    @com_google_absl//absl/strings target.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1696593600">- update to 20230802.1:
  * Add StdcppWaiter to the end of the list of waiter
    implementations</changelog>
  <changelog author="dmueller@suse.com" date="1705665600">- fix build for non-SUSE distributions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709467200">- update to 20240116.1:
  * Add absl::NoDestructor&lt;T&gt; to simplify defining static types
    that do not need to be destructed upon program exit.
  * Add configurable verbose logging (also known as VLOG).
  * Added absl::Overload(), which returns a functor that provides
    overloads based on the functors passed to it. Note that this
    functionality requires C++17 or newer.
  * Breaking Change: AbslHashValue() no longer accepts C-style
    arrays as a parameter, caller need to wrap C-string literals in
    absl::string_view.
  * Breaking Change: absl::weak_equality and absl::strong_equality
    have been removed. The corresponding std types were removed
    before C++20 was finalized</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1712836800">- SLE-only: import upstream patch to fix build with gcc7 in C++17
  mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261)
  + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1739966400">- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1236438)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop</changelog>
</package>
<package pkgid="051f1e8b3461e6c5177bcb394833a976359a8f4747e06e8def3d614c1b724447" name="abseil-cpp-devel" arch="aarch64">
  <version epoch="0" ver="20240116.3" rel="150600.19.3.15"/>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="jengelh@inai.de" date="1649073600">- Implement shlib packaging policy</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1656504000">- Add options-old.patch, options-cxx17.patch (boo#1203378)
  * Ensure ABI stability regardless of compiler settings per instruction in the header.</changelog>
  <changelog author="fvogt@suse.com" date="1656504001">- Remove obsolete 0%{suse_version} &lt; 1500 conditions</changelog>
  <changelog author="elimat@opensuse.org" date="1656849600">- Update to version 20220623.0
  What's New:
  * Added absl::AnyInvocable, a move-only function type.
  * Added absl::CordBuffer, a type for buffering data for eventual inclusion an
    absl::Cord, which is useful for writing zero-copy code.
  * Added support for command-line flags of type absl::optional&lt;T&gt;.
  Breaking Changes:
  * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control
    whether or not unit tests are built.
  * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that
    are experiencing new warnings can use -Wno-deprecated-declatations silence
  the warnings or use -Wno-error=deprecated-declarations to see warnings but
  not fail the build.
  * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some
    compilers are more strict about where this keyword must appear compared to
  the pre-C++20 implementation.
  * Bazel builds now depend on the bazelbuild/bazel-skylib repository.
    See Abseil's WORKSPACE file for an example of how to add this dependency.
  Other:
  * This will be the last release to support C++11. Future releases will require at least C++14.
- run spec-cleaner</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1657540800">- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
  <changelog author="dmueller@suse.com" date="1664020800">- update to 20220623.1:
  * minor warning fix</changelog>
  <changelog author="adrian@suse.de" date="1682337600">- update to 20230125.2
  What's New:
    The Abseil logging library has been released. This library
    provides facilities for writing short text messages about the
    status of a program to stderr, disk files, or other sinks
    (via an extension API). See the logging library documentation
    for more information.
    An extension point, AbslStringify(), allows user-defined types
    to seamlessly work with Abseil's string formatting functions
    like absl::StrCat() and absl::StrFormat().
    A library for computing CRC32C checksums has been added.
    Floating-point parsing now uses the Eisel-Lemire algorithm,
    which provides a significant speed improvement.
    The flags library now provides suggestions for the closest
    flag(s) in the case of misspelled flags.
    Using CMake to install Abseil now makes the installed artifacts
    (in particular absl/base/options.h) reflect the compiled ABI.
  Breaking Changes:
    Abseil now requires at least C++14 and follows Google's Foundational
    C++ Support Policy. See this table for a list of currently supported
    versions compilers, platforms, and build tools.
    The legacy spellings of the thread annotation macros/functions
    (e.g. GUARDED_BY()) have been removed by default in favor of the
    ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
    other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
    can be defined on the compile command-line to temporarily restore these
    spellings, but this compatibility macro will be removed in the future.
  Known Issues
    The Abseil logging library in this release is not a feature-complete
    replacement for glog yet. VLOG and DFATAL are examples of features
    that have not yet been released.
- obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch</changelog>
  <changelog author="adrian@suse.de" date="1685016000">- update to 20230125.3
  Details can be found on:
    https://github.com/abseil/abseil-cpp/releases/tag/20230125.3</changelog>
  <changelog author="fvogt@suse.com" date="1688040000">- Add baselibs.conf to make protobuf happy. Hopefully temporary.</changelog>
  <changelog author="fstrba@suse.com" date="1691582400">- Fix build on older systems by requiring C++17 compliant compiler
- Added patch:
  * cmake.patch
    + lower the cmake requirement to 3.5 in order to be able to
    build on SLE12SP5</changelog>
  <changelog author="adrian@suse.de" date="1694088000">- update to 20230802.0
  What's New:
  * Added the nullability library for designating the expected
    nullability of pointers. Currently these serve as annotations
    only, but it is expected that compilers will one day be able
    to use these annotations for diagnostic purposes.
  * Added the prefetch library as a portable layer for moving data
    into caches before it is read.
  * Abseil's hash tables now detect many more programming errors
    in debug and sanitizer builds.
  * Abseil's synchronization objects now differentiate absolute
    waits (when passed an absl::Time) from relative waits (when
    passed an absl::Duration) when the underlying platform supports
    differentiating these cases. This only makes a difference when
    system clocks are adjusted.
  * Abseil's flag parsing library includes additional methods that
    make it easier to use when another library also expects to be
    able to parse flags.
  * absl::string_view is now available as a smaller target,
    @com_google_absl//absl/strings:string_view, so that users may
    use this library without depending on the much larger
    @com_google_absl//absl/strings target.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1696593600">- update to 20230802.1:
  * Add StdcppWaiter to the end of the list of waiter
    implementations</changelog>
  <changelog author="dmueller@suse.com" date="1705665600">- fix build for non-SUSE distributions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709467200">- update to 20240116.1:
  * Add absl::NoDestructor&lt;T&gt; to simplify defining static types
    that do not need to be destructed upon program exit.
  * Add configurable verbose logging (also known as VLOG).
  * Added absl::Overload(), which returns a functor that provides
    overloads based on the functors passed to it. Note that this
    functionality requires C++17 or newer.
  * Breaking Change: AbslHashValue() no longer accepts C-style
    arrays as a parameter, caller need to wrap C-string literals in
    absl::string_view.
  * Breaking Change: absl::weak_equality and absl::strong_equality
    have been removed. The corresponding std types were removed
    before C++20 was finalized</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1712836800">- SLE-only: import upstream patch to fix build with gcc7 in C++17
  mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261)
  + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1739966400">- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1236438)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop</changelog>
</package>
<package pkgid="1ae7cc8d3cd430b5fee782180cd14fb43cfbe217831b56ae096dc4a3f4737936" name="abseil-cpp-devel" arch="ppc64le">
  <version epoch="0" ver="20240116.3" rel="150600.19.3.15"/>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="jengelh@inai.de" date="1649073600">- Implement shlib packaging policy</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1656504000">- Add options-old.patch, options-cxx17.patch (boo#1203378)
  * Ensure ABI stability regardless of compiler settings per instruction in the header.</changelog>
  <changelog author="fvogt@suse.com" date="1656504001">- Remove obsolete 0%{suse_version} &lt; 1500 conditions</changelog>
  <changelog author="elimat@opensuse.org" date="1656849600">- Update to version 20220623.0
  What's New:
  * Added absl::AnyInvocable, a move-only function type.
  * Added absl::CordBuffer, a type for buffering data for eventual inclusion an
    absl::Cord, which is useful for writing zero-copy code.
  * Added support for command-line flags of type absl::optional&lt;T&gt;.
  Breaking Changes:
  * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control
    whether or not unit tests are built.
  * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that
    are experiencing new warnings can use -Wno-deprecated-declatations silence
  the warnings or use -Wno-error=deprecated-declarations to see warnings but
  not fail the build.
  * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some
    compilers are more strict about where this keyword must appear compared to
  the pre-C++20 implementation.
  * Bazel builds now depend on the bazelbuild/bazel-skylib repository.
    See Abseil's WORKSPACE file for an example of how to add this dependency.
  Other:
  * This will be the last release to support C++11. Future releases will require at least C++14.
- run spec-cleaner</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1657540800">- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
  <changelog author="dmueller@suse.com" date="1664020800">- update to 20220623.1:
  * minor warning fix</changelog>
  <changelog author="adrian@suse.de" date="1682337600">- update to 20230125.2
  What's New:
    The Abseil logging library has been released. This library
    provides facilities for writing short text messages about the
    status of a program to stderr, disk files, or other sinks
    (via an extension API). See the logging library documentation
    for more information.
    An extension point, AbslStringify(), allows user-defined types
    to seamlessly work with Abseil's string formatting functions
    like absl::StrCat() and absl::StrFormat().
    A library for computing CRC32C checksums has been added.
    Floating-point parsing now uses the Eisel-Lemire algorithm,
    which provides a significant speed improvement.
    The flags library now provides suggestions for the closest
    flag(s) in the case of misspelled flags.
    Using CMake to install Abseil now makes the installed artifacts
    (in particular absl/base/options.h) reflect the compiled ABI.
  Breaking Changes:
    Abseil now requires at least C++14 and follows Google's Foundational
    C++ Support Policy. See this table for a list of currently supported
    versions compilers, platforms, and build tools.
    The legacy spellings of the thread annotation macros/functions
    (e.g. GUARDED_BY()) have been removed by default in favor of the
    ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
    other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
    can be defined on the compile command-line to temporarily restore these
    spellings, but this compatibility macro will be removed in the future.
  Known Issues
    The Abseil logging library in this release is not a feature-complete
    replacement for glog yet. VLOG and DFATAL are examples of features
    that have not yet been released.
- obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch</changelog>
  <changelog author="adrian@suse.de" date="1685016000">- update to 20230125.3
  Details can be found on:
    https://github.com/abseil/abseil-cpp/releases/tag/20230125.3</changelog>
  <changelog author="fvogt@suse.com" date="1688040000">- Add baselibs.conf to make protobuf happy. Hopefully temporary.</changelog>
  <changelog author="fstrba@suse.com" date="1691582400">- Fix build on older systems by requiring C++17 compliant compiler
- Added patch:
  * cmake.patch
    + lower the cmake requirement to 3.5 in order to be able to
    build on SLE12SP5</changelog>
  <changelog author="adrian@suse.de" date="1694088000">- update to 20230802.0
  What's New:
  * Added the nullability library for designating the expected
    nullability of pointers. Currently these serve as annotations
    only, but it is expected that compilers will one day be able
    to use these annotations for diagnostic purposes.
  * Added the prefetch library as a portable layer for moving data
    into caches before it is read.
  * Abseil's hash tables now detect many more programming errors
    in debug and sanitizer builds.
  * Abseil's synchronization objects now differentiate absolute
    waits (when passed an absl::Time) from relative waits (when
    passed an absl::Duration) when the underlying platform supports
    differentiating these cases. This only makes a difference when
    system clocks are adjusted.
  * Abseil's flag parsing library includes additional methods that
    make it easier to use when another library also expects to be
    able to parse flags.
  * absl::string_view is now available as a smaller target,
    @com_google_absl//absl/strings:string_view, so that users may
    use this library without depending on the much larger
    @com_google_absl//absl/strings target.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1696593600">- update to 20230802.1:
  * Add StdcppWaiter to the end of the list of waiter
    implementations</changelog>
  <changelog author="dmueller@suse.com" date="1705665600">- fix build for non-SUSE distributions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709467200">- update to 20240116.1:
  * Add absl::NoDestructor&lt;T&gt; to simplify defining static types
    that do not need to be destructed upon program exit.
  * Add configurable verbose logging (also known as VLOG).
  * Added absl::Overload(), which returns a functor that provides
    overloads based on the functors passed to it. Note that this
    functionality requires C++17 or newer.
  * Breaking Change: AbslHashValue() no longer accepts C-style
    arrays as a parameter, caller need to wrap C-string literals in
    absl::string_view.
  * Breaking Change: absl::weak_equality and absl::strong_equality
    have been removed. The corresponding std types were removed
    before C++20 was finalized</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1712836800">- SLE-only: import upstream patch to fix build with gcc7 in C++17
  mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261)
  + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1739966400">- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1236438)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop</changelog>
</package>
<package pkgid="1389c11ec0e51ba9b67f2260ee762ae906c226c2b03002ae9f348554fec6720d" name="abseil-cpp-devel" arch="s390x">
  <version epoch="0" ver="20240116.3" rel="150600.19.3.15"/>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="jengelh@inai.de" date="1649073600">- Implement shlib packaging policy</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1656504000">- Add options-old.patch, options-cxx17.patch (boo#1203378)
  * Ensure ABI stability regardless of compiler settings per instruction in the header.</changelog>
  <changelog author="fvogt@suse.com" date="1656504001">- Remove obsolete 0%{suse_version} &lt; 1500 conditions</changelog>
  <changelog author="elimat@opensuse.org" date="1656849600">- Update to version 20220623.0
  What's New:
  * Added absl::AnyInvocable, a move-only function type.
  * Added absl::CordBuffer, a type for buffering data for eventual inclusion an
    absl::Cord, which is useful for writing zero-copy code.
  * Added support for command-line flags of type absl::optional&lt;T&gt;.
  Breaking Changes:
  * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control
    whether or not unit tests are built.
  * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that
    are experiencing new warnings can use -Wno-deprecated-declatations silence
  the warnings or use -Wno-error=deprecated-declarations to see warnings but
  not fail the build.
  * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some
    compilers are more strict about where this keyword must appear compared to
  the pre-C++20 implementation.
  * Bazel builds now depend on the bazelbuild/bazel-skylib repository.
    See Abseil's WORKSPACE file for an example of how to add this dependency.
  Other:
  * This will be the last release to support C++11. Future releases will require at least C++14.
- run spec-cleaner</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1657540800">- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
  <changelog author="dmueller@suse.com" date="1664020800">- update to 20220623.1:
  * minor warning fix</changelog>
  <changelog author="adrian@suse.de" date="1682337600">- update to 20230125.2
  What's New:
    The Abseil logging library has been released. This library
    provides facilities for writing short text messages about the
    status of a program to stderr, disk files, or other sinks
    (via an extension API). See the logging library documentation
    for more information.
    An extension point, AbslStringify(), allows user-defined types
    to seamlessly work with Abseil's string formatting functions
    like absl::StrCat() and absl::StrFormat().
    A library for computing CRC32C checksums has been added.
    Floating-point parsing now uses the Eisel-Lemire algorithm,
    which provides a significant speed improvement.
    The flags library now provides suggestions for the closest
    flag(s) in the case of misspelled flags.
    Using CMake to install Abseil now makes the installed artifacts
    (in particular absl/base/options.h) reflect the compiled ABI.
  Breaking Changes:
    Abseil now requires at least C++14 and follows Google's Foundational
    C++ Support Policy. See this table for a list of currently supported
    versions compilers, platforms, and build tools.
    The legacy spellings of the thread annotation macros/functions
    (e.g. GUARDED_BY()) have been removed by default in favor of the
    ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
    other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
    can be defined on the compile command-line to temporarily restore these
    spellings, but this compatibility macro will be removed in the future.
  Known Issues
    The Abseil logging library in this release is not a feature-complete
    replacement for glog yet. VLOG and DFATAL are examples of features
    that have not yet been released.
- obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch</changelog>
  <changelog author="adrian@suse.de" date="1685016000">- update to 20230125.3
  Details can be found on:
    https://github.com/abseil/abseil-cpp/releases/tag/20230125.3</changelog>
  <changelog author="fvogt@suse.com" date="1688040000">- Add baselibs.conf to make protobuf happy. Hopefully temporary.</changelog>
  <changelog author="fstrba@suse.com" date="1691582400">- Fix build on older systems by requiring C++17 compliant compiler
- Added patch:
  * cmake.patch
    + lower the cmake requirement to 3.5 in order to be able to
    build on SLE12SP5</changelog>
  <changelog author="adrian@suse.de" date="1694088000">- update to 20230802.0
  What's New:
  * Added the nullability library for designating the expected
    nullability of pointers. Currently these serve as annotations
    only, but it is expected that compilers will one day be able
    to use these annotations for diagnostic purposes.
  * Added the prefetch library as a portable layer for moving data
    into caches before it is read.
  * Abseil's hash tables now detect many more programming errors
    in debug and sanitizer builds.
  * Abseil's synchronization objects now differentiate absolute
    waits (when passed an absl::Time) from relative waits (when
    passed an absl::Duration) when the underlying platform supports
    differentiating these cases. This only makes a difference when
    system clocks are adjusted.
  * Abseil's flag parsing library includes additional methods that
    make it easier to use when another library also expects to be
    able to parse flags.
  * absl::string_view is now available as a smaller target,
    @com_google_absl//absl/strings:string_view, so that users may
    use this library without depending on the much larger
    @com_google_absl//absl/strings target.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1696593600">- update to 20230802.1:
  * Add StdcppWaiter to the end of the list of waiter
    implementations</changelog>
  <changelog author="dmueller@suse.com" date="1705665600">- fix build for non-SUSE distributions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709467200">- update to 20240116.1:
  * Add absl::NoDestructor&lt;T&gt; to simplify defining static types
    that do not need to be destructed upon program exit.
  * Add configurable verbose logging (also known as VLOG).
  * Added absl::Overload(), which returns a functor that provides
    overloads based on the functors passed to it. Note that this
    functionality requires C++17 or newer.
  * Breaking Change: AbslHashValue() no longer accepts C-style
    arrays as a parameter, caller need to wrap C-string literals in
    absl::string_view.
  * Breaking Change: absl::weak_equality and absl::strong_equality
    have been removed. The corresponding std types were removed
    before C++20 was finalized</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1712836800">- SLE-only: import upstream patch to fix build with gcc7 in C++17
  mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261)
  + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1739966400">- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1236438)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop</changelog>
</package>
<package pkgid="2fbe289accea1525cfc2be8549ab71eec520cd7bd8fac86fa66118d28a1dce46" name="abseil-cpp-devel" arch="x86_64">
  <version epoch="0" ver="20240116.3" rel="150600.19.3.15"/>
  <changelog author="rpm@fthiessen.de" date="1619352000">- Update to LTS version 20210324.1
  * Fixed missing absl::Cleanup
  * Fixed pkgconfig install path
- Dropped upstream merged Correctly-install-pkgconfig.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1625054400">- Update to version 20210324.2 (LTS):
  * No user visible changes, only build system related</changelog>
  <changelog author="dmueller@suse.com" date="1641297600">- update to 20211102.0:
  * absl::Cord is now implemented as a b-tree. The new implementation offers
    improved performance in most workloads.
  * absl::SimpleHexAtoi() has been added to strings library for parsing
    hexadecimal strings</changelog>
  <changelog author="danilo.spinella@suse.com" date="1646395200">- Fix build on SLE-12-SP5</changelog>
  <changelog author="jengelh@inai.de" date="1649073600">- Implement shlib packaging policy</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1656504000">- Add options-old.patch, options-cxx17.patch (boo#1203378)
  * Ensure ABI stability regardless of compiler settings per instruction in the header.</changelog>
  <changelog author="fvogt@suse.com" date="1656504001">- Remove obsolete 0%{suse_version} &lt; 1500 conditions</changelog>
  <changelog author="elimat@opensuse.org" date="1656849600">- Update to version 20220623.0
  What's New:
  * Added absl::AnyInvocable, a move-only function type.
  * Added absl::CordBuffer, a type for buffering data for eventual inclusion an
    absl::Cord, which is useful for writing zero-copy code.
  * Added support for command-line flags of type absl::optional&lt;T&gt;.
  Breaking Changes:
  * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control
    whether or not unit tests are built.
  * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that
    are experiencing new warnings can use -Wno-deprecated-declatations silence
  the warnings or use -Wno-error=deprecated-declarations to see warnings but
  not fail the build.
  * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some
    compilers are more strict about where this keyword must appear compared to
  the pre-C++20 implementation.
  * Bazel builds now depend on the bazelbuild/bazel-skylib repository.
    See Abseil's WORKSPACE file for an example of how to add this dependency.
  Other:
  * This will be the last release to support C++11. Future releases will require at least C++14.
- run spec-cleaner</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1657540800">- Add Fix-maes-msse41-leaking-into-pkgconfig.patch
  * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379)</changelog>
  <changelog author="dmueller@suse.com" date="1664020800">- update to 20220623.1:
  * minor warning fix</changelog>
  <changelog author="adrian@suse.de" date="1682337600">- update to 20230125.2
  What's New:
    The Abseil logging library has been released. This library
    provides facilities for writing short text messages about the
    status of a program to stderr, disk files, or other sinks
    (via an extension API). See the logging library documentation
    for more information.
    An extension point, AbslStringify(), allows user-defined types
    to seamlessly work with Abseil's string formatting functions
    like absl::StrCat() and absl::StrFormat().
    A library for computing CRC32C checksums has been added.
    Floating-point parsing now uses the Eisel-Lemire algorithm,
    which provides a significant speed improvement.
    The flags library now provides suggestions for the closest
    flag(s) in the case of misspelled flags.
    Using CMake to install Abseil now makes the installed artifacts
    (in particular absl/base/options.h) reflect the compiled ABI.
  Breaking Changes:
    Abseil now requires at least C++14 and follows Google's Foundational
    C++ Support Policy. See this table for a list of currently supported
    versions compilers, platforms, and build tools.
    The legacy spellings of the thread annotation macros/functions
    (e.g. GUARDED_BY()) have been removed by default in favor of the
    ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with
    other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS
    can be defined on the compile command-line to temporarily restore these
    spellings, but this compatibility macro will be removed in the future.
  Known Issues
    The Abseil logging library in this release is not a feature-complete
    replacement for glog yet. VLOG and DFATAL are examples of features
    that have not yet been released.
- obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch</changelog>
  <changelog author="adrian@suse.de" date="1685016000">- update to 20230125.3
  Details can be found on:
    https://github.com/abseil/abseil-cpp/releases/tag/20230125.3</changelog>
  <changelog author="fvogt@suse.com" date="1688040000">- Add baselibs.conf to make protobuf happy. Hopefully temporary.</changelog>
  <changelog author="fstrba@suse.com" date="1691582400">- Fix build on older systems by requiring C++17 compliant compiler
- Added patch:
  * cmake.patch
    + lower the cmake requirement to 3.5 in order to be able to
    build on SLE12SP5</changelog>
  <changelog author="adrian@suse.de" date="1694088000">- update to 20230802.0
  What's New:
  * Added the nullability library for designating the expected
    nullability of pointers. Currently these serve as annotations
    only, but it is expected that compilers will one day be able
    to use these annotations for diagnostic purposes.
  * Added the prefetch library as a portable layer for moving data
    into caches before it is read.
  * Abseil's hash tables now detect many more programming errors
    in debug and sanitizer builds.
  * Abseil's synchronization objects now differentiate absolute
    waits (when passed an absl::Time) from relative waits (when
    passed an absl::Duration) when the underlying platform supports
    differentiating these cases. This only makes a difference when
    system clocks are adjusted.
  * Abseil's flag parsing library includes additional methods that
    make it easier to use when another library also expects to be
    able to parse flags.
  * absl::string_view is now available as a smaller target,
    @com_google_absl//absl/strings:string_view, so that users may
    use this library without depending on the much larger
    @com_google_absl//absl/strings target.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1696593600">- update to 20230802.1:
  * Add StdcppWaiter to the end of the list of waiter
    implementations</changelog>
  <changelog author="dmueller@suse.com" date="1705665600">- fix build for non-SUSE distributions</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1709467200">- update to 20240116.1:
  * Add absl::NoDestructor&lt;T&gt; to simplify defining static types
    that do not need to be destructed upon program exit.
  * Add configurable verbose logging (also known as VLOG).
  * Added absl::Overload(), which returns a functor that provides
    overloads based on the functors passed to it. Note that this
    functionality requires C++17 or newer.
  * Breaking Change: AbslHashValue() no longer accepts C-style
    arrays as a parameter, caller need to wrap C-string literals in
    absl::string_view.
  * Breaking Change: absl::weak_equality and absl::strong_equality
    have been removed. The corresponding std types were removed
    before C++20 was finalized</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1712836800">- SLE-only: import upstream patch to fix build with gcc7 in C++17
  mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261)
  + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1739966400">- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1236438)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop</changelog>
</package>
<package pkgid="42dcf970293472bb732f51de9557ee94b542febf1fcb4f52f71440710be190bd" name="accountsservice" arch="aarch64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="09497799f67747937bc9e15688f0d4e8c58f976d70f970f00b5b2569fd32f127" name="accountsservice" arch="ppc64le">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="2a4dba4e19a79a7d610243c56e69121e0731498689dfe9d3c4bb896a2737e4f8" name="accountsservice" arch="s390x">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="75ab11c799901f522a2ce3835cd07883d33c510340bb01330c2160541302a1f9" name="accountsservice" arch="src">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="541b61e564f95ed417e604c5d092c4a06fb1bdf60bd303636ce109d9c917e1d9" name="accountsservice" arch="x86_64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="3fedfcbf152e14b45f4b08cf596dbce147340ea1d046103a92628dfdbe062f1d" name="accountsservice-devel" arch="aarch64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="d2712eccd005913017566f8ed73a2a0d7de527a10b43f74ff8c7eff141b7871c" name="accountsservice-devel" arch="ppc64le">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="47c8586501a0e747c53dc4125c197e01cdb4c3768045361b1f0401f33d79479a" name="accountsservice-devel" arch="s390x">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="09bfca2b3196c22ab558c48d1e3d613b16a8acf485a0a2d79853ab733be6a0d2" name="accountsservice-devel" arch="x86_64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="5fb2947ced4441611e459d6bab7dfb89e5b941f3759bf4b90887ea33c48bf057" name="accountsservice-lang" arch="noarch">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="6b6ec3eb082757fca531602f60da32e27c7af54b5525886da98eabc93018f5ba" name="accountsservice-vala" arch="aarch64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="09a15f427e466f4df797e4029e4289de2c94dd40600129d346c4497ac95ca154" name="accountsservice-vala" arch="ppc64le">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="cdb38f90729894189c8fcf24cb6af29464e623775d435be2011af8bfcc829cba" name="accountsservice-vala" arch="s390x">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="4216be8598cb0c65c6508d5bea54d3093eb1cd7ab3aeaeb830679c08614d918d" name="accountsservice-vala" arch="x86_64">
  <version epoch="0" ver="23.13.9" rel="150600.3.3.2"/>
  <changelog author="xwang@suse.com" date="1557316800">- Update accountsservice-read-root-user-cache.patch.
  upstream commit d8b77951
  (bsc#1114292 glfo#accountsservice/accountsservice#65).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559131200">- Update to version 0.6.55:
  + Memory leak fix.
  + Improved heuristics for identifying user session.
  + Export interfaces directory to pkgconfig.
  + Lock down state directory from prying eyes to be more friendly to
    accountsservice extensions that require privacy.
  + Misc fixes.
  + Updated translations.
- Drop accountsservice-upstream-fixes.patch: Fixed upstream.
- Refresh patches with refresh_patches osc service.</changelog>
  <changelog author="fezhang@suse.com" date="1568203200">- Add accountsservice-wtmp-io-improvements.patch: Backports that
  improve wtmp io performance (boo#1139487).
- Refresh as-fate318433-prevent-same-account-multi-logins.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1586865600">- Apply as-fate318433-prevent-same-account-multi-logins.patch to Leap.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1614686400">- Add accountsservice-fix-gdm-crash.patch: Prevent crash of gdm
  upon service restart when automatic login is enabled
  (glfo#accountsservice/accountsservice#55).</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added patch(es):
  * harden_accounts-daemon.service.patch</changelog>
  <changelog author="yfjiang@suse.com" date="1628510400">- Spec layout cleaning up for harden_accounts-daemon.service.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1629979200">- Update harden_accounts-daemon.service.patch: Do not proect home
  directories: the accounts daemon is used to create home
  directories upon user creation (boo#1189853).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636027200">- Stop passing the no longer used nor recognized option
  user-heuristics=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1643716800">- Add ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch: Fix build
  with meson 0.61.0.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651320000">- Update to version 22.08.8
  + Handle missing admin groups when changing account types
  + Set PrivateTmp to false in the systemd service
  + Add function to set user password expiration policy
- Update to version 22.04.62
  + Updated Swedish translation
  + Updated Indonesian translation
  + Updated German translation
  + Updated slovak translation
  + Update Ukrainian translation
  + Updated Brazilian Portuguese translation
  + act-user: Use stronger hashing methods in make_crypted() if available.
  + act-user-manager: Watch for the daemon going away and coming back
  + user-manager: Update users tables on username changes
  + user: Translate property x-session property name to match the proxy one
  + Check GDBusMessage for INTERACTIVE_AUTHORIZATION flag
  + daemon: Fix error check in save_autologin()
  + Never delete the root filesystem when removing users
  + Remove user heuristics
  + user-classify: Add git to username blacklist
  + daemon: ensure cache files for system users are processed
  + daemon: Don't try to add admin users to non existing groups
  + Move D-Bus conf file to $(datadir)/dbus-1/system.d
- Rebased patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch
  + as-fate318433-prevent-same-account-multi-logins.patch
- Drop upstream fixed patches:
  + ac9b14f1c1bbca413987d0bbfeaad05804107e9a.patch
  + accountsservice-fix-gdm-crash.patch
  + accountsservice-read-root-user-cache.patch
  + accountsservice-wtmp-io-improvements.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1659096000">- Allow to build without vala support.
- Refresh harden_accounts-daemon.service.patch to not duplicate
  existing entries.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1659355200">- Remove BuildIgnore for rpmlint-mini. This is a violation of the
  security policies applying to SUSE products as it circumvents the
  SUSE security team's control over what enters Factory and what
  not.</changelog>
  <changelog author="rpm@fthiessen.de" date="1687348800">- Update to version 23.13.9:
  + daemon: Fix boot delay
  + user-manager:
  - Add cancellable to fetch user requests
  - Track non-existent users
- Changes from version 23.11.69:
  + Add lightdm autologin support
  + user:
  - Return an error when setting invalid language
  - Throw a warning for invalid locales
  - Support new LocalAccount property in cache file
  - Replace usermod -p with chpasswd -e
  + main:
  - Use new overridable USERDIR
  - Use new overridable ICONDIR
  - Use new overridable sysconfdir
  + daemon:
  - Add GetUsersLanguages() function
  - Don't crash if /etc/shadow doesn't exist
  + Updated translations.
- Rebase patches:
  + accountsservice-sysconfig.patch
  + accountsservice-filter-suse-accounts.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1687608000">- Add accountsservice-assume-gdm.patch: assume gdm when not being
  able to detect the used display manager. This is basically the
  same as was in place before we gained support for multiple DMs
  (boo#1212675).</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1688558400">- Rebase accountsservice-sysconfig.patch: (boo#1212675 boo#1212973).
- Remove accountsservice-assume-gdm.patch: Fixed by new rebasing
  of accountsservice-sysconfig.patch.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1691582400">- Rebase as-fate318433-prevent-same-account-multi-logins.patch:
  (bsc#1213884).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1736769600">- Update accountsservice-sysconfig.patch: Avoid the warning
  "assertion 'G_IS_DBUS_INTERFACE_SKELETON (interface_)' failed"
  (bsc#1234249).</changelog>
</package>
<package pkgid="2a5ce95b2a866ecf949ecd093516f7038ac096782a90f0ad09bf2f2693b2182f" name="adcli" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="5d206fc9bfd44445feff4928554de09f57f5341fecfa8dc1f55a7d885ff14a9a" name="adcli" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="831cdac2e89526ff995ac71ed5d33d9c775097578d32b3b264c90fb8e3f229a2" name="adcli" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="889ff13178298bf1963808b97ebcfb1178351f54392eea293180cd07e045e7a3" name="adcli" arch="src">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="a036f64118fa2fab0b9fb93848b8e212c8d58b7984edbbcba8014e77481ecdde" name="adcli" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="b1712d05e08fc20f3c0578dbe07a871446baf74580f62d92645f2e934abd9613" name="adcli-doc" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="b91ec3ca4454d3f9f22db74dadf9ee420cee670a3ad8fdfbf6f09b73cd69ae71" name="adcli-doc" arch="ppc64le">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="92c45a4a3ec8979ceb109b7a57626f206197eeca999f51e583243577fc9e29f2" name="adcli-doc" arch="s390x">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="a90cc5e9af514ffbdcf92731157cb83667aaf1b05a61ecd55f8535e91ea891b3" name="adcli-doc" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150400.17.8.3"/>
  <changelog author="ckowalczyk@suse.com" date="1537531200">- Initial build (fate#326619, bsc#1109849)</changelog>
  <changelog author="scabrero@suse.de" date="1574337600">- The userPrincipalName attribute was not added to the created
  machine (bsc#1157491)
- The host FQDN was not properly detected (bsc#1157491)
- Added patches:
  * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch
  * 0002-Use-strdup-if-offsets-are-used.patch
  * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch
  * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch
  * 0005-library-add-adcli_conn_is_writeable.patch
  * 0006-Handle-kvno-increment-for-RODCs.patch
  * 0007-library-add-_adcli_bin_sid_to_str.patch
  * 0008-library-add-_adcli_call_external_program.patch
  * 0009-library-add-_adcli_ldap_parse_sid.patch
  * 0010-library-add-lookup_domain_sid.patch
  * 0011-library-add-adcli_conn_get_domain_sid.patch
  * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch
  * 0013-Add-trusted-for-delegation-option.patch
  * 0014-Only-update-attributes-given-on-the-command-line.patch
  * 0015-update-allow-to-add-service-names.patch
  * 0016-Calculate-enctypes-in-a-separate-function.patch
  * 0017-join-add-all-attributes-while-creating-computer-obje.patch
  * 0018-util-add-_adcli_strv_remove_unsorted.patch
  * 0019-Add-add-service-principal-and-remove-service-princip.patch
  * 0020-Do-not-add-service-principals-twice.patch
  * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch
  * 0022-adutil-add-_adcli_strv_add_unique.patch
  * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch
  * 0024-Increment-kvno-after-password-change-with-user-creds.patch
  * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1582200000">- Use GSS-SPNEGO if available (bsc#1162518)
  * 0026-Use-GSS-SPNEGO-if-available.patch
- Add option to use ldaps (bsc#1162518)
  * 0027-add-option-use-ldaps.patch</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets database after changing the machine password
  (jsc#sle-11503)
  * 0028-tools-add-option-add-samba-data.patch
  * 0029-tools-store-Samba-data-if-requested.patch
  * 0030-make-Samba-data-tool-configurable.patch
  * 0031-fix-typo-in-flag-value.patch
  * 0032-samba-data-tool-needs-to-take-an-argument.patch
  * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch
- Support testjoin command (jsc#sle-11503)
  * 0034-Implement-adcli-testjoin.patch</changelog>
  <changelog author="scabrero@suse.de" date="1617969600">- Respect allowed Kerberos encryption types; (bsc#1184462);
  Add 0035-handle-encryption-types.patch</changelog>
  <changelog author="scabrero@suse.de" date="1635163200">- Add --dont-expire-password option; (jsc#sle-21225);
  * 0036-Add-dont-expire-password-option.patch
  * 0037-Fix-for-dont-expire-password-option-and-join.patch</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- Remove errx() calls on error conditions to execute the cleanup
  function and delete the krb5 snippets created in /tmp;
  (bsc#1202647);
  * Add 0038-Remove-errx-from-tools.patch
- Set umask before calling mkdtemp; (bsc#1202647);
  * Add 0039-Set-umask-before-calling-mkdtemp.patch</changelog>
  <changelog author="scabrero@suse.de" date="1691582400">- Write SID before secret to Samba's db; (bsc#1214076);
  Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch</changelog>
  <changelog author="scabrero@suse.de" date="1702987200">- Populate Samba's secrets database using offline domain join;
  (bsc#1214076); Add
  0041-populate-samba-secrets-using-offline-domain-join.patch</changelog>
</package>
<package pkgid="e41e03155f6230cd934ec0406d6ae6bfe92e0b87dc5c7545d868e56881f9fa38" name="alsa-ucm-conf" arch="noarch">
  <version epoch="0" ver="1.2.10" rel="150600.3.5.1"/>
  <changelog author="tiwai@suse.de" date="1609848000">- Backport upstream fixes: HD-audio dual codec fixes and the builtin
  mic fix for rt5645-based devices:
  0010-HDA-Intel-HiFi-dual-Add-EnableSequence-and-DisableSe.patch
  0011-HDA-Intel-HiFi-dual-Add-BootSequence-and-disable-pla.patch
  0012-chtrt5645-Enable-Internal-MIC-of-ECS-EF20EA.patch</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  more Baytrail/Cherrytrail profiles, TRX40 / ALC1220-VLC profiles:
  0013-bytcr-rt5640-Add-support-for-devices-without-speaker.patch
  0014-rt5640-Move-standard-DAC-setup-to-EnableSeq.conf.patch
  0015-bytcr-rt5640-fix-the-execution-order.patch
  0016-ucm2-add-initial-configuration-for-TRX40-Gigabyte-Ao.patch
  0017-USB-Audio-ALC1220-Bump-analog-Speaker-priority-over-.patch
  0018-USB-Audio-ALC1220-fix-indentation-for-Speaker-device.patch
  0019-USB-Audio-fix-indentation-in-Gigabyte-Aorus-Master-M.patch
  0020-chtnau8824-Add-a-SST-define-variable.patch
  0021-kblrt5660-Fix-file-permissions.patch
- Run fdupes to reduce the duplicated files</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 1.2.5
  * tegra: Add UCM for more devices
  * codecs/rt5640: Make headset optional
  * rt715: add mic led support
  * bytcr-rt5640: Add support for controlling a speaker-mute LED
  * cht-bsw-rt5672: Add support for controlling speaker- and
    mic-mute LEDs, Add support for the components string
  * ucm2: add support to for Qualcomm RB5 Platform
  * codecs/rt5672: Add hardware volume-control support
  * codecs/rt5640: Add hardware volume-control support
  * bytcr-wm5102: Add new UCM profile for BYT boards with a WM5102 codec
  * bytcr-rt5640: Add support for devices without speakers and/or
    an internal mic
  * chtrt5645: Enable Internal MIC of ECS EF20EA
  * chtnau8824: Add support for laptops using stereo DMICs and fix
    mono speaker config not working
  * Full changes:
    https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5#alsa-ucm-conf
- Drop upstream fixes
  * 0001-fix-the-ucm2-codecs-hda-hdmi.conf-use.patch
  * 0002-codecs-hda-hdmi.conf-add-DisplayPort-to-the-device-d.patch
  * 0003-sof-soundwire-use-the-codecs-hda-hdmi.conf-macro.patch
  * 0004-Revert-ucm2-HDA-acp-add-Capture-simple-mixer-element.patch
  * 0005-chtnau8824-Fix-mono-speaker-config-not-working.patch
  * 0006-chtnau8824-Add-support-for-laptops-using-stereo-DMIC.patch
  * 0007-chtnau8824-Boost-analog-mic-volumes-a-bit.patch
  * 0008-rt715-init-setup-ADC07-to-a-proper-volume.patch
  * 0009-sof-hda-dsp-Set-Master-Playback-Switch-on-in-the-Boo.patch
  * 0010-HDA-Intel-HiFi-dual-Add-EnableSequence-and-DisableSe.patch
  * 0011-HDA-Intel-HiFi-dual-Add-BootSequence-and-disable-pla.patch
  * 0012-chtrt5645-Enable-Internal-MIC-of-ECS-EF20EA.patch
  * 0013-bytcr-rt5640-Add-support-for-devices-without-speaker.patch
  * 0014-rt5640-Move-standard-DAC-setup-to-EnableSeq.conf.patch
  * 0015-bytcr-rt5640-fix-the-execution-order.patch
  * 0016-ucm2-add-initial-configuration-for-TRX40-Gigabyte-Ao.patch
  * 0017-USB-Audio-ALC1220-Bump-analog-Speaker-priority-over-.patch
  * 0018-USB-Audio-ALC1220-fix-indentation-for-Speaker-device.patch
  * 0019-USB-Audio-fix-indentation-in-Gigabyte-Aorus-Master-M.patch
  * 0020-chtnau8824-Add-a-SST-define-variable.patch
  * 0021-kblrt5660-Fix-file-permissions.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623240000">- Fix for HDA config lookup (boo#1187079):
  0001-HDA-Intel-the-lookups-are-supported-from-syntax-4.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to version 1.2.5.1:
  a small bugfix release, including the previous patch
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patch:
  0001-HDA-Intel-the-lookups-are-supported-from-syntax-4.patch</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to version 1.2.6:
  various profile updates.  See URL below for details:
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-ucm-conf
- Add *.sig file for the tarball
- Explicit Requires for the libasound2 with the same or newer
  version</changelog>
  <changelog author="tiwai@suse.de" date="1639137600">- Update to version 1.2.6.1:
  a minor fix release:
  * acp: fix linked configuration
  * ucm2: Add support for SC7180 Trogdor Lazor Chromebooks
  * USB-Audio: fix the wrong condition type for If.realtek-alc1220-vb
- More a couple of upstream fixes for forgotten conversions:
  0001-sof-hda-dsp-fix-path-to-Hdmi.conf.patch
  0002-bytcht-es8316-fix-Include-paths-in-HiFi.conf.patch</changelog>
  <changelog author="tiwai@suse.de" date="1639137601">- Update to version 1.2.6.2:
  a minor fix release, just includnig ther previous fixes
- Drop obsoleted patches
  0001-sof-hda-dsp-fix-path-to-Hdmi.conf.patch
  0002-bytcht-es8316-fix-Include-paths-in-HiFi.conf.patch</changelog>
  <changelog author="tiwai@suse.de" date="1640520000">- Update to version 1.2.6.3:
  * ucm2/Qualcomm/apq8096: Change plughw to hw to access card
  * ucm2/Qualcomm/apq8016-sbc: Change plughw to hw to access card
  * ucm2: Add support for RT5650 on MediaTek SoCs
  * sof-soundwire: use absolute path in SectionUseCase</changelog>
  <changelog author="tiwai@suse.de" date="1640865600">- Fix a regression in HDA-DualCodecs:
  0001-HDA-DualCodecs-fix-typo-in-Speaker-condition.patch</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix regression for AMD ACP LED control:
  0002-HDA-acp-avoid-to-create-Mic-ACP-LED-control-for-the-.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to version 1.2.7:
  Various profile updates for USB-audio, HD-audio, etc.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-ucm-conf
- Drop obsoleted patches:
  0001-HDA-DualCodecs-fix-typo-in-Speaker-condition.patch
  0002-HDA-acp-avoid-to-create-Mic-ACP-LED-control-for-the-.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654516800">- Backport upstream fixes for Steinberg UR44:
  0001-Steinberg-UR44-fix-the-Line2-channel-mapping.patch
  0002-Steinberg-UR44-fix-the-Line2-channel-mapping-2nd.patch
  0003-Steinberg-UR44-fix-the-direction-for-steinberg_ur44_.patch</changelog>
  <changelog author="tiwai@suse.com" date="1655726400">- Update to version 1.2.7.1:
  updates of various device-specific profiles.  For details, see
  https://www.alsa-project.org/wiki/Changes_v1.2.7_v1.2.7.1#alsa-ucm-conf
- Drop obsoleted patches:
  0001-Steinberg-UR44-fix-the-Line2-channel-mapping.patch
  0002-Steinberg-UR44-fix-the-Line2-channel-mapping-2nd.patch
  0003-Steinberg-UR44-fix-the-direction-for-steinberg_ur44_.patch</changelog>
  <changelog author="tiwai@suse.com" date="1658145600">- Update to version 1.2.7.2:
    updates of various device-specific profiles.  For details, see
  https://www.alsa-project.org/wiki/Changes_v1.2.7.1_v1.2.7.2#alsa-ucm-conf</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to version 1.2.8 (jsc#PED-850):
  lots of new profiles for USB-audio, SOF and others:
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to version 1.2.9:
  various profile updates for USB-audio, SOF and others.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-ucm-conf</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to version 1.2.10 (jsc#PED-6566):
  * updates / fixes for various devices: mtk-rt5650, usb-audio, tegra
    es8316, sof-essx8336, pinephone, Steinberg UR44C, AMD ACP RPL,
    ACP63, sof-hda-dsp, etc
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-ucm-conf
- Upstream regression fix:
  0001-SplitPCM-Device-argument-may-not-be-set.patch</changelog>
  <changelog author="tiwai@suse.com" date="1750420800">- Improved HD-audio Mic LED handling (bsc#1243695):
  0002-common-add-led.conf-with-SetLED-macro-to-hide-implem.patch
  0003-ucm2-use-new-SetLED-macro-to-hide-the-implementation.patch
  0004-ucm2-HDA-HiFi-analog-mic-Refactor-the-analog-mic-dis.patch
  0005-ucm2-HDA-remove-HDA-Capture-value.conf-and-put-conte.patch
  0006-HDA-move-led.conf-include-to-more-appropriate-place.patch
  0007-HDA-mics-prefer-Mic-Jack-instead-Headphone-Jack.patch
  0008-HDA-mics-improve-the-Jack-selection.patch
  0009-HDA-mics-don-t-create-conflict-link-for-Headphone-Mi.patch
  0010-acppdmmach-add-support-for-ACP-7.0.patch</changelog>
  <changelog author="tiwai@suse.com" date="1751544000">- Correct / update the previous backported patches</changelog>
</package>
<package pkgid="58ecc9b657b0bb45db47dcb3bb9a269469e1bc3f3df223b4fc44d5ca8e09bb68" name="alsa-ucm-conf" arch="src">
  <version epoch="0" ver="1.2.10" rel="150600.3.5.1"/>
  <changelog author="tiwai@suse.de" date="1609848000">- Backport upstream fixes: HD-audio dual codec fixes and the builtin
  mic fix for rt5645-based devices:
  0010-HDA-Intel-HiFi-dual-Add-EnableSequence-and-DisableSe.patch
  0011-HDA-Intel-HiFi-dual-Add-BootSequence-and-disable-pla.patch
  0012-chtrt5645-Enable-Internal-MIC-of-ECS-EF20EA.patch</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  more Baytrail/Cherrytrail profiles, TRX40 / ALC1220-VLC profiles:
  0013-bytcr-rt5640-Add-support-for-devices-without-speaker.patch
  0014-rt5640-Move-standard-DAC-setup-to-EnableSeq.conf.patch
  0015-bytcr-rt5640-fix-the-execution-order.patch
  0016-ucm2-add-initial-configuration-for-TRX40-Gigabyte-Ao.patch
  0017-USB-Audio-ALC1220-Bump-analog-Speaker-priority-over-.patch
  0018-USB-Audio-ALC1220-fix-indentation-for-Speaker-device.patch
  0019-USB-Audio-fix-indentation-in-Gigabyte-Aorus-Master-M.patch
  0020-chtnau8824-Add-a-SST-define-variable.patch
  0021-kblrt5660-Fix-file-permissions.patch
- Run fdupes to reduce the duplicated files</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 1.2.5
  * tegra: Add UCM for more devices
  * codecs/rt5640: Make headset optional
  * rt715: add mic led support
  * bytcr-rt5640: Add support for controlling a speaker-mute LED
  * cht-bsw-rt5672: Add support for controlling speaker- and
    mic-mute LEDs, Add support for the components string
  * ucm2: add support to for Qualcomm RB5 Platform
  * codecs/rt5672: Add hardware volume-control support
  * codecs/rt5640: Add hardware volume-control support
  * bytcr-wm5102: Add new UCM profile for BYT boards with a WM5102 codec
  * bytcr-rt5640: Add support for devices without speakers and/or
    an internal mic
  * chtrt5645: Enable Internal MIC of ECS EF20EA
  * chtnau8824: Add support for laptops using stereo DMICs and fix
    mono speaker config not working
  * Full changes:
    https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5#alsa-ucm-conf
- Drop upstream fixes
  * 0001-fix-the-ucm2-codecs-hda-hdmi.conf-use.patch
  * 0002-codecs-hda-hdmi.conf-add-DisplayPort-to-the-device-d.patch
  * 0003-sof-soundwire-use-the-codecs-hda-hdmi.conf-macro.patch
  * 0004-Revert-ucm2-HDA-acp-add-Capture-simple-mixer-element.patch
  * 0005-chtnau8824-Fix-mono-speaker-config-not-working.patch
  * 0006-chtnau8824-Add-support-for-laptops-using-stereo-DMIC.patch
  * 0007-chtnau8824-Boost-analog-mic-volumes-a-bit.patch
  * 0008-rt715-init-setup-ADC07-to-a-proper-volume.patch
  * 0009-sof-hda-dsp-Set-Master-Playback-Switch-on-in-the-Boo.patch
  * 0010-HDA-Intel-HiFi-dual-Add-EnableSequence-and-DisableSe.patch
  * 0011-HDA-Intel-HiFi-dual-Add-BootSequence-and-disable-pla.patch
  * 0012-chtrt5645-Enable-Internal-MIC-of-ECS-EF20EA.patch
  * 0013-bytcr-rt5640-Add-support-for-devices-without-speaker.patch
  * 0014-rt5640-Move-standard-DAC-setup-to-EnableSeq.conf.patch
  * 0015-bytcr-rt5640-fix-the-execution-order.patch
  * 0016-ucm2-add-initial-configuration-for-TRX40-Gigabyte-Ao.patch
  * 0017-USB-Audio-ALC1220-Bump-analog-Speaker-priority-over-.patch
  * 0018-USB-Audio-ALC1220-fix-indentation-for-Speaker-device.patch
  * 0019-USB-Audio-fix-indentation-in-Gigabyte-Aorus-Master-M.patch
  * 0020-chtnau8824-Add-a-SST-define-variable.patch
  * 0021-kblrt5660-Fix-file-permissions.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623240000">- Fix for HDA config lookup (boo#1187079):
  0001-HDA-Intel-the-lookups-are-supported-from-syntax-4.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to version 1.2.5.1:
  a small bugfix release, including the previous patch
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patch:
  0001-HDA-Intel-the-lookups-are-supported-from-syntax-4.patch</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to version 1.2.6:
  various profile updates.  See URL below for details:
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-ucm-conf
- Add *.sig file for the tarball
- Explicit Requires for the libasound2 with the same or newer
  version</changelog>
  <changelog author="tiwai@suse.de" date="1639137600">- Update to version 1.2.6.1:
  a minor fix release:
  * acp: fix linked configuration
  * ucm2: Add support for SC7180 Trogdor Lazor Chromebooks
  * USB-Audio: fix the wrong condition type for If.realtek-alc1220-vb
- More a couple of upstream fixes for forgotten conversions:
  0001-sof-hda-dsp-fix-path-to-Hdmi.conf.patch
  0002-bytcht-es8316-fix-Include-paths-in-HiFi.conf.patch</changelog>
  <changelog author="tiwai@suse.de" date="1639137601">- Update to version 1.2.6.2:
  a minor fix release, just includnig ther previous fixes
- Drop obsoleted patches
  0001-sof-hda-dsp-fix-path-to-Hdmi.conf.patch
  0002-bytcht-es8316-fix-Include-paths-in-HiFi.conf.patch</changelog>
  <changelog author="tiwai@suse.de" date="1640520000">- Update to version 1.2.6.3:
  * ucm2/Qualcomm/apq8096: Change plughw to hw to access card
  * ucm2/Qualcomm/apq8016-sbc: Change plughw to hw to access card
  * ucm2: Add support for RT5650 on MediaTek SoCs
  * sof-soundwire: use absolute path in SectionUseCase</changelog>
  <changelog author="tiwai@suse.de" date="1640865600">- Fix a regression in HDA-DualCodecs:
  0001-HDA-DualCodecs-fix-typo-in-Speaker-condition.patch</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix regression for AMD ACP LED control:
  0002-HDA-acp-avoid-to-create-Mic-ACP-LED-control-for-the-.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to version 1.2.7:
  Various profile updates for USB-audio, HD-audio, etc.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-ucm-conf
- Drop obsoleted patches:
  0001-HDA-DualCodecs-fix-typo-in-Speaker-condition.patch
  0002-HDA-acp-avoid-to-create-Mic-ACP-LED-control-for-the-.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654516800">- Backport upstream fixes for Steinberg UR44:
  0001-Steinberg-UR44-fix-the-Line2-channel-mapping.patch
  0002-Steinberg-UR44-fix-the-Line2-channel-mapping-2nd.patch
  0003-Steinberg-UR44-fix-the-direction-for-steinberg_ur44_.patch</changelog>
  <changelog author="tiwai@suse.com" date="1655726400">- Update to version 1.2.7.1:
  updates of various device-specific profiles.  For details, see
  https://www.alsa-project.org/wiki/Changes_v1.2.7_v1.2.7.1#alsa-ucm-conf
- Drop obsoleted patches:
  0001-Steinberg-UR44-fix-the-Line2-channel-mapping.patch
  0002-Steinberg-UR44-fix-the-Line2-channel-mapping-2nd.patch
  0003-Steinberg-UR44-fix-the-direction-for-steinberg_ur44_.patch</changelog>
  <changelog author="tiwai@suse.com" date="1658145600">- Update to version 1.2.7.2:
    updates of various device-specific profiles.  For details, see
  https://www.alsa-project.org/wiki/Changes_v1.2.7.1_v1.2.7.2#alsa-ucm-conf</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to version 1.2.8 (jsc#PED-850):
  lots of new profiles for USB-audio, SOF and others:
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to version 1.2.9:
  various profile updates for USB-audio, SOF and others.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-ucm-conf</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to version 1.2.10 (jsc#PED-6566):
  * updates / fixes for various devices: mtk-rt5650, usb-audio, tegra
    es8316, sof-essx8336, pinephone, Steinberg UR44C, AMD ACP RPL,
    ACP63, sof-hda-dsp, etc
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-ucm-conf
- Upstream regression fix:
  0001-SplitPCM-Device-argument-may-not-be-set.patch</changelog>
  <changelog author="tiwai@suse.com" date="1750420800">- Improved HD-audio Mic LED handling (bsc#1243695):
  0002-common-add-led.conf-with-SetLED-macro-to-hide-implem.patch
  0003-ucm2-use-new-SetLED-macro-to-hide-the-implementation.patch
  0004-ucm2-HDA-HiFi-analog-mic-Refactor-the-analog-mic-dis.patch
  0005-ucm2-HDA-remove-HDA-Capture-value.conf-and-put-conte.patch
  0006-HDA-move-led.conf-include-to-more-appropriate-place.patch
  0007-HDA-mics-prefer-Mic-Jack-instead-Headphone-Jack.patch
  0008-HDA-mics-improve-the-Jack-selection.patch
  0009-HDA-mics-don-t-create-conflict-link-for-Headphone-Mi.patch
  0010-acppdmmach-add-support-for-ACP-7.0.patch</changelog>
  <changelog author="tiwai@suse.com" date="1751544000">- Correct / update the previous backported patches</changelog>
</package>
<package pkgid="aadfaf231783955907aa0712b8327b209d2fc677185b1fbce21455dc449f2f9b" name="alsa-utils" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="3f5b5e08f99e34808667930276a6e540149ecb7a30738e6782587a65cab763a0" name="alsa-utils" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="6e527990f3414ab6cda072d7f7b8d0ddda3393ac1bf66f2e09d21ddbf4baf930" name="alsa-utils" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="d375e08488dff04267649a9d60967f7ddcb9aec06d4856eb93c60eaae44aac14" name="alsa-utils" arch="src">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="b8f325a5003dac4e0eb05e2d48d66f538225d38d6517fc5d90c0ed0df1ada08f" name="alsa-utils" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="09451b04a6be37da44537ec0468de4db2425180e2b50ed0ac7e04f368e82656d" name="alsabat" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="30d78502134ce8291cb53f6c99be7f25126036b0dedc31bcefe0322b42e240aa" name="alsabat" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="40610a8f5d6e7bcb2386e3b8e819cb2c4372f40b2c32ddf6d9cbf666585536ed" name="alsabat" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="7b8497d7ea0cb3d111ccd080af47652c41e5607794c9eabb037848a7220e2e83" name="alsabat" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="7d2271e51c31274a1c902aa7f79911b66d9710d32b779bb344310f882d928dfa" name="amazon-ssm-agent" arch="aarch64">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.20.1"/>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
</package>
<package pkgid="37cd962a269180ad12007f3bc7d17985cbdd6cc58e0a6f0fca17860db21ff00f" name="amazon-ssm-agent" arch="src">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.20.1"/>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
</package>
<package pkgid="0225df60c0b66ba1a03c49f11d439904cb4e4beaa357db7a7d9e315760ed7192" name="amazon-ssm-agent" arch="x86_64">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.20.1"/>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
</package>
<package pkgid="d41383736a8e065e686183473e2b570efcde4f18bb19e22482bc7f2b0c0d0ed8" name="amazon-ssm-agent" arch="aarch64">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.23.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1741348800">- Add patch to fix proxy bypass using IPv6 zone IDs in golang.org/x/net
  * CVE-2025-22870.patch (bsc#1238702, CVE-2025-22870)</changelog>
</package>
<package pkgid="860634c71eb18f9db5cb591f154a4d29d50f4e889cb66a47ba67363739515b19" name="amazon-ssm-agent" arch="src">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.23.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1741348800">- Add patch to fix proxy bypass using IPv6 zone IDs in golang.org/x/net
  * CVE-2025-22870.patch (bsc#1238702, CVE-2025-22870)</changelog>
</package>
<package pkgid="83ef8233dfff84604b20f1b6e0b44c013d13a6c3e9b4f10c58f8a7eb0803fbec" name="amazon-ssm-agent" arch="x86_64">
  <version epoch="0" ver="3.3.1611.0" rel="150000.5.23.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624622400">- Update to version 3.0.1295.0
  + Added configurable custom identity and identity consumption order
  + Added cross-account domain join
  + Added cleanup for older versions of updater artifacts
  + Added a workaround for MacOS kernel bug that sometimes kept RunCommand from launching
  + Added a workaround for log file contention on Windows
  + Added synchronization to RunCommand service stop
  + Changed hibernation log level
  + MacOS executables are now signed
  + Removed delay in non-interactive session type</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650456000">- Update to version 3.1.1260.0
  + Added missing check for invalid S3 path parameter
  + Added support for domain join using a non-local username
  + Fixed broken links in README.md
  + Fixed ECS Exec issue where agent was using environment variables for credentials
  + Updated Ec2Detector test to query smbios directly for system information
- from version 3.1.1208.0
  + Updated ec2detector module to use Get-CmiInstance instead of wmic.exe
  + Fixed file creation mode of ssm-agent-users sudoer file (bsc#1196556, CVE-2022-29527)
- from version 3.1.1188.0
  + Added new ec2detector module to determine if agent is on EC2
  + Added support for port forwarding to remote host
  + Added quotes around inventory parameter ValueName on Windows
  + Fix for domain join DNS IP assignments in shared directories
  + Replaced namedpipe updater test with ec2detector test
- from version 3.1.1141.0
  + Add application inventory by file for Bottlerocket
  + Fix infinite retry logic to send failed replies in MGSInteractor
  + Remove usage of io/fs package
- from version 3.1.1080.0
  + (windows only) Remove symlink scan during update
- from version 3.1.1045.0
  + Fixed sourceHash validation for aws:application document plugin
  + Added document parameter validation for values passed to target document of aws:runDocument plugin
  + (windows only) Fix process leak when legacy cloudwatch plugin is enabled
  + (windows only) Fail installation if C:\ProgramData\Amazon\SSM\ has symlinks
- from version 3.1.1004.0
  + Added platform detection for Bottlerocket OS
  + Consolidated regional endpoint generation to common endpoint module
- from version 3.1.941.0
  + Added support for Rocky linux
  + Fixed sharefile/shareprofile not being propagated to updateutil
  + Fixed incorrect darwin platform detection post BigSur
  + Fixed log flush issue in updater
  + Updated .NET dependencies for domainjoin and cloudwatch (windows only)
  + Updated go version to 1.17.6
- from version 3.1.821.0
  + Implement new core module named MessageService to start processing commands from both MGS and MDS
  * Merge functionalities from RunCommandService core module and Session core module.
  * Receive run command documents through MGS if connected and fallback to MDS otherwise.
    This functionality requires appropriate permissions for both endpoints and will be rolled
    out gradually to end users.
  * Provide filesystem based idempotency check to avoid duplicate run command document execution.
  * Increase default run command pool buffer size from 1 to 5 to load additional documents
    before-hand for processing.
  + Fix nil pointer deference panic produced in named pipe test case during agent update
  + Remove StopType concept in ssm-agent-worker and add different waits for reboot and shutdown stop
- from version 3.1.804.0
  + Add support for upstart when running get-diagnostic command using ssm-cli
  + Fix systemctl service name to support older versions of systemctl
  + Include changes to facilitate testing
  + Update DNS server selection logic for seamless domain join on linux and darwin
  + Update go version to go1.17.5
  + Update golang sys package dependency
- from version 3.1.715.0
  + Derive default directories from appconfig on Darwin
  + Set x-bit on newly-created directories
- from version 3.1.634.0
  + Fix for ssm-setup-cli to be able to select service manager without the agent being installed
- from version 3.1.630.0
  + Added greengrass component recipe for the new SystemsManagerAgent component
  + Added support for registering agent on a greengrass device
  + Added support for downloading more than 1000 objects in downloadContent
  + Fixed retry logic for onprem and s3 upload
  + Fixed unit tests when running on Mac
  + Update AWS SDK to v1.41.4
  + Update logic to retrieve platform details for Rocky Linux
- from version 3.1.501.0
  + Add diagnostics command to ssm-cli
  + Fix caching for onprem credentials
  + Additional configuration options for Seamless Domain Join
  + Gracefully exit session if group of runas user is modified
  + Skip retries for cert validation errors in S3 HEAD requests
  + Fix DNS failures on CentOS 8.2
  + Update several dependencies
- from version 3.1.459.0
  + Fixed a bug with powershell command for Inventory
- from version 3.1.426.0
  + Fixed cpu spike issue manifesting on snap
  + Fixed issue with version comparison in EC2Config update plugin
  + Fixed panic when command output was being truncated
  + Updated build to use go1.16.8
  + Removed Profile from inventory powershell commands on Windows
- from version 3.1.338.0
  + Fix to eliminate WaitGroup reuse panic triggered during agent reboot
  + Fix to include applications without UninstallString in Inventory for Windows
  + Fixed a bug where multi-plugin documents with large outputs would timeout RunCommand
  + Fixed a bug where RunCommand could delay executions for up to 15 minutes
- from version 3.1.282.0
  + Add serial port logging of AwsNitroEnclaves package version on windows during startup
  + Allow usage of existing loggroup/logstream when the user does not have create permission
  + Change service interrogate request log to debug
  + Cleanup old surveyor channel files on startup
  + Fix filehandle leak in windows leading to agent going offline
  + Fix to schedule correct next run time during orchestration directories cleanup
  + Fix to sequentially update correct runcount value in the document bookkeeping file
  + Fix a bug with version parsing EC2Config updater
  + Updated rpm packaging for fips compliance
- from version 3.1.192.0
  + Added darwin arm64 to makefile
  + Added logic to limit orchestration directory cleanup
  + Added packaging for public SSM Agent container image
  + Fixed cloudwatch endpoint for telemetry metrics requests
  + Fixed handling of Windows filepaths and mutex locks
  + Fixed agent worker handling of OS signals and termination channel requests
  + Updated datachannel retry strategy to not retry for a specific error scenario
  + Updated default gomaxproc value for Windows
  + Update build to use go1.16.6
- from version 3.1.127.0
  + Added a workaround for windows random halts
  + Fixed race condition during reboot document execution
- from version 3.1.90.0
  + Updated to version 3.1
  + Updated build to build statically linked binaries for linux 64bit
  * Minimum supported linux kernel version for linux 64bit is 3.2+
  + Fixed permissions for docker config file
  + Fixed issue with ubuntu prerm and postinst scripts
  + Fixed issue where processor stop was being called twice
- from version 3.0.1390.0
  + Added config option to delete orchestration folder
  + Added snapcraft packaging config
  + Added workaround for aws:runDocument status bug
  + Added improved handling of file closure
  + Added support for go mod and updated build to use go 1.16.4
  + Fixed bug parsing vpce s3 urls
  + Refactored use of agent identity in agent cli
  + Updated check if agent is running as windows service
  + Updated handling of session cancellation to still send output to client side
  + Updated interactive session exit code logic to match non-interactive mode
  + Updated vendor dependencies
- Update directory path for GOPATH</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1650542400">- Fix mangled ExlusiveArch field</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1667304000">- Update to version 3.1.1856.0
  + Lower message length threshold for cloudwatch log streaming
  + Ran gofmt and goimports with golang version 1.19
  + Report AvailabilityZone and AvailabilityZoneId in health pings
  + Update AWS Go SDK to v1.44.78
  + from version 3.1.1767.0
  + Fix samba configuration for sub-domains
  + from version 3.1.1732.0
  + Add code in document/session worker to fallback to default
    identity selector when runtime config not present
  + Fix to handle command-line-arguments in document/session
    worker when launched by old agent workers
- from version 3.1.1634.0
  + Fallback to file based IPC if named pipe creation times out
  + Increase tls handshake timeout in http download client
  + Log mds client timeout errors as WARN
- from version 3.1.1575.0
  + Added separate metric for snapd running apps failure during update
  + Fixed idle session timeout with smux keep alive configuration based on CLI version
  + Updated AgentTaskComplete message retry
  + Updated go version to 1.18.3
- from version 3.1.1511.0
  + Collect kernel version in InstanceDetailedInformation
  + Support separate output stream for non-interactive session
  + Cleanup default log group name for runcommands
  + Updated rpm spec file to include build id
- from version 3.1.1476.0
  + Fix port session premature close when local server is not connected before timeout
- from version 3.1.1446.0
  + Add created date to AgentJobAck message
  + Disable smux keep alive to use idle session timeout feature
  + Fix unit-tests running on windows
- from version 3.1.1374.0
  + Added timeout for s3 HEAD requests
  + Added vpc address deny to port forwarding
  + Fixed for reboot scenario in configure package plugin
  + Fixed goroutine leak in seelog library
  + Fixed nullpointer segmentation fault in configure package plugin
  + Improved error handling in manifest download in updater
  + Improved worker initialization to improve startup failure logging</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1669204800">- Update to version 3.2.286.0
  + Separated EC2 identity vault manifest from OnPrem identity vault manifest
  + Fix for credential retrieval blocking os termination signals
  + Fix for agent updater using shared credentials on EC2
  + Added guards against panic for agent identity health checks
  + Added logging around agent module start/stop
- from version 3.2.183.0
  + Added logging when assuming identity
  + Increased retries to ECS metadata endpoint
  + Added linux debug build to makefile
  + Implemented aws sdk logging interface
  + Updated agent minor version to 3.2
  + Added functionality to retrieve agent credentials from Systems Manager on EC2
- from version 3.1.1927.0
  + Update shell for Session Manager on MacOS</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673611200">- Update to version 3.2.419.0
  + Added minimum retry sleep for Registrar RegisterManagedInstance calls
  + Explicitly skip AZ info check for on-prem and ECS targets
  + Fix for SSM-Agent that is unable to start on Apple Mac M1's (mac2.metal instances)
  + Ensuring powershell path is set to system directory on Windows
  + Load DLLs with using system/absolute paths on Windows
  + Added workaround for Samba limit when loading Active Directory ids
  + Dynamically get network interface name for SeamlessDomainJoin
  + Added install-yum-rpm to makefile to install agent on host from source code
  + Added logging for specifying credential source
  + Refactored tests to remove mocks from production binaries
  + Updated Windows DomainJoin plugin SharpZipLib and Newtonsoft.json dependencies
- from version 3.2.345.0
  + Updated yaml.v3 dependency</changelog>
  <changelog author="dmueller@suse.com" date="1681646400">- update to 3.2.815.0:
  * Add EC2 credential fallback for AssumeRoleUnauthorizedAccess
    error
  * Add CloudWatch log upload support for document and session
    worker
  * Add set-hostname support in domainjoin plugin for windows
  * Add wait time in Agent updater to avoid installation issues
    caused during reboots initiated by domainjoin plugin
  * Add support for AlmaLinux
  * Fix KeepHostName parameter without DNS IP address parameter
    in domainJoin plugin
  * Fix issue where carriage returns cause json conversion to
    fail in aws:softwareInventory plugin
  * Remove IMDS calls in Onprem during health check
  * Remove S3 global endpoint fallback logic
  * Update cli descriptions for registration parameters
  * Update go version to 1.19.6
- update to 3.2.582.0:
  * Modified EC2 credential fallback logic
- update to 3.2.574.0:
  * Fixed go-vet issues by passing mocks by value
  * Updated domainjoin and cloudwatch executables for windows
- update to 3.2.532.0:
  * Removed explicit setting of EC2 aws credential profile
  * Added public key to registration info
  * Sends non-interactive command errors that occur before
    command execution to data channel
  * Added instance id verification to registration process</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684756800">- Update to version 3.2.923.0
  * Update Dockerfile Go version to 1.19
  * Add reporting of MGS connection status
  * Add support for updating to agent version marked stable
  * Add status code to MGS ack and send on message process failure
  * Update golangci-lint configuration
  * Add e2e tag to session shell tests</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 3.2.1478.0
  * Added fix to propagate exit code properly when command fails to start
  * Added control channel acknowledgement functionalities
  * Added flag to specify go version used for gosec and
    govulncheck in static analysis script
  * Added support for RHEL 8.7, 8.8, 9.1, 9.2
  * Added support for Rocky Linux 8.7, 9.0, 9.1, 9.2
  * Added support for Oracle Linux 8.7, 9.1, 9.2
  * Update go version to 1.20.7
- from version 3.2.1377.0
  * Stopped saving instance profile credentials to disk
  * Added static agent security scans to makefile
  * Updated Greengrass component minor version
- from version 3.2.1297.0
  * Added retries to snap uninstall call in setupcli
  * Fix for windows shutdown executable not found when compiled with golang1.19+
  * Fix to return correct Agent Job ID for ack after AgentJobParseError
  * Pass golang contexts for network calls in agent core to terminate cleanly
  * Remove credential file dependency in agent workers implemented in 3.2.x.x versions
  * Report MGS Connection Channel status to Health table
  * Update Dockerfile to use Golang image from ECR repository
- from version 3.2.1241.0
  * Get bucket region using signed HeadBucket request
  * Updated golang.org/x/net version to 0.10.0 and
    golang.org/x/crypto version to 0.9.0
  * Update go version to 1.19.10
- from version 3.2.1041.0
  * Add retry to handle stream data acknowledge messages
  * Support latest as a version in configurePackage plugin
  * Updated AWS GO SDK to v1.44.261 and disabled IMDSv1 fallback logic
  * Use IP address to connect to destination server in port session
- from version 3.2.985.0
  * Add Domain Join support for RHEL 8.7 and AL2022
  * Add Support to send aws:updateSSMAgent replies through MGS
  * Retrieve and set interface name dynamically in
    aws:domainJoin plugin for Ubuntu</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 3.2.1798.0
  * Bump golang.org/x/net from 0.15.0 to 0.17.0
  * Upgraded GoLang to version 1.20.10
  * Fixing race condition in session datachannel unit test
- from version 3.2.1705.0
  * Updated MGS Interactor to send 'Failed' status on agentJob parsing error
  * Added error handling for Linux DomainJoin when service account credentials empty
  * Fix for panic scenario in when running aws:configureDocker plugin
  * Upgraded GoLang to version 1.20.8
  * Upgraded golang.org/x/net to v0.15.0
  * Added support for macOS 13 (Ventura)
- from version 3.2.1630.0
  * Fix credential retrieval retry logic in credential refresher
  * Reducing retrieval log level to debug in the credential
    refresher after more than 3 retrieval retries
  * Fix for EC2 credential retrieval errors not being
    propagated to the credential refresher
  * Fixing agent version input format validation
  * Fix downloadPlatformOverride for AlmaLinux
  * Fixed issue where removing seelog.xml file doesn't
    revert minimum log level back to INFO
  * Ignore non-audit files in audit folder
- from version 3.2.1542.0
  * Add aws:updateSSMAgent plugin support for Flatcar Linux
  * Add fix to resolve manifest url during agent update when using stable keyword
  * Fix multiple issues causing tight loops during IPC connection scenarios
  * Sign deb and rpm installer packages for Linux instances using new key
  * Use file based IPC by default for amazon-ssm-agent
    and ssm-agent-worker communication in Darwin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707825600">- Update to version 3.3.40.0
  * Fix issue to execute aws:updateSSMAgent plugin through aws:rundocument plugin
  * Update Messaging module to switch off ec2messages
    when ssmmessages connected successfully
  * Update SSM Agent Minor version from 3.2 to 3.3
- from version 3.2.2222.0
  * Upgrade minimum go version in go.mod file to go 1.19
  * Upgrade go-git package to v5.11.0
  * Fix for bad default manifest url when updating EC2Config
- from version 3.2.2143.0
  * Fixed plugin path traversal logic
  * Updated aws:application plugin default param
  * Fixed default param in psmodule
  * Upgraded GoLang to version 1.21.5
- from version 3.2.2086.0
  * Added Agent config to configure session logs destination
  * Added data channel acknowledgement functionalities
  * Added redirect handler and timeout for HTTP client
  * Added steps to verify aws-cli installation for domainJoin plugin
  * Added support for Ubuntu 23.04, Debian 11.7 &amp; 12, and SUSE 15.5
  * Adjusted random number generator logic used to get filename in downloadContent plugin
  * Fixed Agent to gather application inventory from both rpm and
    dpkg package managers if present in Unix instances
  * Bump golang.org/x/crypto/ssh from 0.14.0 to 0.17.0
- from version 3.2.2016.0
  * Added telemetry for agent core in-proc executor usage
  * Added retries for Agent installation with snap on Greengrass
  * Added code to update Agent config to use only Onprem Identity in Greengrass
  * Added support for macOS 14 (Sonoma)
  * Added Onprem registration support using ssm-setup-cli
  * Fixed docker installation issues in aws:configureDocker plugin
  * Fix for document worker and session worker not logging when
    custom seelog configuration missing parameters
  * Updated allowed regex pattern in S3 URI
  * Update Agent IoT Greengrass component minor version
  * Updated SUSE version in Seamless Domain Join script
  * Updated Greengrass component workflow to get installed Agent version and update
    Agent only when the installed Agent version doesn't match with Greengrass
    component Agent version
  * Upgraded GoLang version that builds agent binaries with to 1.20.11
- Update Go version requirement to 1.21</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712318400">- Update to version 3.3.217.0
  * Add alternative outputs for agent package generation scripts
  * Add support for Oracle 8.8 &amp; 8.9, Rocky 8.8 &amp; 8.9,
    AlmaLinux 8.8 &amp; 8.9, and RHEL 8.9 &amp; 9.3
  * Fix flaky integration test
  * Fix setup-cli error code for non English systems
  * Set IPR creds expiry to 30 mins for ssm agent worker
  * Switch installer package manager from rpm to yum on OSes that support yum
  * Upgrade GoLang to version 1.21.8
- from version 3.3.131.0
  * Add integration tests for control channel and data channel module
  * Remove data channel and control channel acknowledgement
    functionality in MGS Interactor
- from version 3.2.2303.0
  * Add integration tests for control channel module
  * Revert data channel and control channel acknowledgement
    functionality in MGS Interactor
  * Update Greengrass component minor version to 1.2.4</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1719921600">- Update to version 3.3.551.0
  * Agent updater attempts yum install/uninstall before falling
    back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to fetch package contents
- from version 3.3.484.0
  * Update SSM-Setup-CLI logs related to checksum validation of latest version
- from version 3.3.418.0
  * Upgrade go-github version from v8 to v61
  * Increase timeouts in SSM-Setup-CLI
  * Fix darwin build issue in SSM-Setup-CLI
  * Fix the command builder bug to handle space char in input value
  * Fix an inaccurate log when validating allowDowngrade parameter during Agent update
  * Signing SSM Agent vended Windows executables
- from version 3.3.380.0
  * Update AWS GO SDK to v1.51.20
- from version 3.3.337.0
  * Remove yum as package manager in linux install/uninstall script
  * Verify TrustedInstaller status before posting WindowsUpdate
    information in aws:softwareInventory plugin</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1730289600">- Update to version 3.3.1142.0
  * Fail windows update when installed version does not match
  * Reduced length of IMDS errors to shorter format
  * Increase the RunCommand timeout during the registration process for the on-prem instances
  * Add nil check when calling GetRepository content in aws:downloadContent
  * Worker process to exit if they are not successfully started and became idle
  * Fix bug where unforeseen failures cause time to be incorrectly displayed in RunCommand
  * Update GreenGrass component minor version to 1.3.0
  * Ensure agent thread always exit after the corresponding worker process exits
  * Fix IPC file filtering bug where usernames or session names containing
    tmp causes agent worker to not correctly receive IPC
  * Load directly from appconfig file when calling UpdateInstanceInformation
    during credential refresher
  * Use a single syscall for route table for health check IP
- from version 3.3.987.0
  * Update default session logging destination to none
  * Specify a minimum of TLS v1.2 in http client calls
  * Add web-socket heartbeat to detect connection drops in the web-socket
    for control and data channels sooner
  * Use exponential retry for document worker, increase retry interval
    and attempt count when reading IPC files
  * Add wait for cloud-init in the agent updater
  * Fix timeouts for update without yum endpoint connectivity
  * Change in orchestration directory removal process to reduce disk space usage
  * Fix Inventory detailed information invalid value check
  * Fix parsing issue with DomainJoin Plugin
  * Modify DomainJoin Plugin to use Kerberos REALM in username for RHEL and variants
  * Change the SUSE linux zypper commands to quiet mode for the DomainJoin Plugin
  * Move high volume info logs to debug level
  * Remove deprecated go coverage library (golang.org/x/tools/cmd/cover)
  * Add lock on session orchestration cleanup to prevent quadratic file
    system lookup for large volume session users
  * Upgrade GoLang to version 1.22.7
- from version 3.3.859.0
  * Updated snapcraft.yml specification
- from version 3.3.808.0
  * Agent updater attempts yum install/uninstall before
    falling back to attempt with rpm
  * Updated golang.org/x/net from v0.19.0 to v0.26.0
  * Upgrade GoLang to version 1.21.11
  * Add IPv6 addresses for NTP and EC2Config to default DenyList
  * Update Distributor to only use Systems Manager APIs to
    fetch package contents</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1736510400">- Update to version 3.3.1345.0
  * Revert "Update configurePackage to use fixed download method"
  * Revert "Use a single syscall for route table for health check IP"
- from version 3.3.1311.0
  * Add alternative to wmic to support Windows 2025
  * Add armv7 architecture support for greengrass component
  * Add support in ssm-setup-cli for standalone installation
    in on-premises environments
  * Fail ssm-setup-cli install command if agent config is not loadable
  * Implement S3 ownership verification as an optional parameter for plugins
  * Mark Session task as cancelled when MGS indicates that session is over
  * Update configurePackage to use fixed download method
  * Update Docker Engine version and use system environment
    variables in installation path
  * Update GreenGrass component minor version to 1.3.1
- from version 3.3.1230.0
  * Revert compatibility hook for future Windows versions as it
    increased CPU consumption for document execution on Windows.
  * Revert Increase RunCommand timeout during the registration
    process for the on-prem instances</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1737115200">- Update to version 3.3.1611.0 (bsc#1235575, CVE-2025-21613)
  * Update aws-sdk-go from 1.51.20 to 1.55.5
  * Update golang.org/x/crypto from 0.24.0 to 0.32.0
  * Update github.com/go-git/go-git/v5 from 5.12.0 to 5.13.1
  * Update golang.org/x/net from 0.26.0 to 0.34.0
  * Update golang.org/x/oauth2 from 0.0.0-20211005180243-6b3c2da341f1
    to 0.24.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1741348800">- Add patch to fix proxy bypass using IPv6 zone IDs in golang.org/x/net
  * CVE-2025-22870.patch (bsc#1238702, CVE-2025-22870)</changelog>
</package>
<package pkgid="3f0ee22ce3eac76d7fcc9d9ad0af84cb3648b8abad76cfbecdfc9bde01d4464b" name="ansible" arch="noarch">
  <version epoch="0" ver="11.3.0" rel="150400.10.3.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706961600">- update to 9.2.0:
  Ansible 9.2.0 includes ansible-core 2.16.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 9.3.0:
  Ansible 9.3.0 includes ansible-core 2.16.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 9.4.0:
  Ansible 9.4.0 includes ansible-core 2.16.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713960000">- update to 9.5.1 (9.5.0 does not exist):
  Ansible 9.5.1 includes ansible-core 2.16.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 9.6.0:
  Ansible 9.6.0 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717761600">- update to 9.6.1:
  Ansible 9.6.1 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 9.7.0:
  Ansible 9.7.0 includes ansible-core 2.16.8 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 10.0.0:
  Ansible 10.0.0 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 10.0.1:
  Ansible 10.0.1 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958402">- update to 10.1.0:
  Ansible 10.1.0 includes ansible-core 2.17.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721217600">- update to 10.2.0:
  Ansible 10.2.0 includes ansible-core 2.17.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 10.3.0:
  Ansible 10.3.0 includes ansible-core 2.17.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 10.4.0:
  Ansible 10.4.0 includes ansible-core 2.17.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 10.5.0:
  Ansible 10.5.0 includes ansible-core 2.17.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 10.6.0:
  Ansible 10.6.0 includes ansible-core 2.17.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- update to 11.0.0
  Ansible 11.0.0 includes ansible-core 2.18.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- introduce next_ansible_core_version to ease updates of
  ansible-core while making sure we keep to the same minor release
  family (2.16.x, 2.17.x, 2.18.x)
- rename ansible-11-rpmlintrc back to ansible-rpmlintrc</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733313600">- update to 11.1.0
  Ansible 11.1.0 includes ansible-core 2.18.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738152000">- update to 11.2.0:
  Ansible 11.2.0 includes ansible-core 2.18.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 11.3.0:
  Ansible 11.3.0 includes ansible-core 2.18.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
</package>
<package pkgid="34afb4f35f4de8f6049af5d572e88bd0689064eff9c690bebae8b9e2380a9aa0" name="ansible" arch="src">
  <version epoch="0" ver="11.3.0" rel="150400.10.3.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706961600">- update to 9.2.0:
  Ansible 9.2.0 includes ansible-core 2.16.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 9.3.0:
  Ansible 9.3.0 includes ansible-core 2.16.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 9.4.0:
  Ansible 9.4.0 includes ansible-core 2.16.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713960000">- update to 9.5.1 (9.5.0 does not exist):
  Ansible 9.5.1 includes ansible-core 2.16.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 9.6.0:
  Ansible 9.6.0 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717761600">- update to 9.6.1:
  Ansible 9.6.1 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 9.7.0:
  Ansible 9.7.0 includes ansible-core 2.16.8 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 10.0.0:
  Ansible 10.0.0 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 10.0.1:
  Ansible 10.0.1 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958402">- update to 10.1.0:
  Ansible 10.1.0 includes ansible-core 2.17.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721217600">- update to 10.2.0:
  Ansible 10.2.0 includes ansible-core 2.17.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 10.3.0:
  Ansible 10.3.0 includes ansible-core 2.17.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 10.4.0:
  Ansible 10.4.0 includes ansible-core 2.17.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 10.5.0:
  Ansible 10.5.0 includes ansible-core 2.17.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 10.6.0:
  Ansible 10.6.0 includes ansible-core 2.17.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- update to 11.0.0
  Ansible 11.0.0 includes ansible-core 2.18.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- introduce next_ansible_core_version to ease updates of
  ansible-core while making sure we keep to the same minor release
  family (2.16.x, 2.17.x, 2.18.x)
- rename ansible-11-rpmlintrc back to ansible-rpmlintrc</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733313600">- update to 11.1.0
  Ansible 11.1.0 includes ansible-core 2.18.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738152000">- update to 11.2.0:
  Ansible 11.2.0 includes ansible-core 2.18.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 11.3.0:
  Ansible 11.3.0 includes ansible-core 2.18.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
</package>
<package pkgid="102d4e7af341ea13e5086c5e01fba2b3f71be141403e8b20f69fed68388a8951" name="ansible" arch="noarch">
  <version epoch="0" ver="11.3.0" rel="150400.10.5.1"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706961600">- update to 9.2.0:
  Ansible 9.2.0 includes ansible-core 2.16.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 9.3.0:
  Ansible 9.3.0 includes ansible-core 2.16.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 9.4.0:
  Ansible 9.4.0 includes ansible-core 2.16.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713960000">- update to 9.5.1 (9.5.0 does not exist):
  Ansible 9.5.1 includes ansible-core 2.16.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 9.6.0:
  Ansible 9.6.0 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717761600">- update to 9.6.1:
  Ansible 9.6.1 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 9.7.0:
  Ansible 9.7.0 includes ansible-core 2.16.8 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 10.0.0:
  Ansible 10.0.0 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 10.0.1:
  Ansible 10.0.1 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958402">- update to 10.1.0:
  Ansible 10.1.0 includes ansible-core 2.17.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721217600">- update to 10.2.0:
  Ansible 10.2.0 includes ansible-core 2.17.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 10.3.0:
  Ansible 10.3.0 includes ansible-core 2.17.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 10.4.0:
  Ansible 10.4.0 includes ansible-core 2.17.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 10.5.0:
  Ansible 10.5.0 includes ansible-core 2.17.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 10.6.0:
  Ansible 10.6.0 includes ansible-core 2.17.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- update to 11.0.0
  Ansible 11.0.0 includes ansible-core 2.18.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- introduce next_ansible_core_version to ease updates of
  ansible-core while making sure we keep to the same minor release
  family (2.16.x, 2.17.x, 2.18.x)
- rename ansible-11-rpmlintrc back to ansible-rpmlintrc</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733313600">- update to 11.1.0
  Ansible 11.1.0 includes ansible-core 2.18.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738152000">- update to 11.2.0:
  Ansible 11.2.0 includes ansible-core 2.18.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 11.3.0:
  Ansible 11.3.0 includes ansible-core 2.18.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
</package>
<package pkgid="90e3a42e4e005321a640ba865c80be20d2a2fcd0397982d0505ee02f980722c6" name="ansible" arch="src">
  <version epoch="0" ver="11.3.0" rel="150400.10.5.1"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706961600">- update to 9.2.0:
  Ansible 9.2.0 includes ansible-core 2.16.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 9.3.0:
  Ansible 9.3.0 includes ansible-core 2.16.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 9.4.0:
  Ansible 9.4.0 includes ansible-core 2.16.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713960000">- update to 9.5.1 (9.5.0 does not exist):
  Ansible 9.5.1 includes ansible-core 2.16.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 9.6.0:
  Ansible 9.6.0 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717761600">- update to 9.6.1:
  Ansible 9.6.1 includes ansible-core 2.16.7 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 9.7.0:
  Ansible 9.7.0 includes ansible-core 2.16.8 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 9
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/9/CHANGELOG-v9.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 10.0.0:
  Ansible 10.0.0 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 10.0.1:
  Ansible 10.0.1 includes ansible-core 2.17.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958402">- update to 10.1.0:
  Ansible 10.1.0 includes ansible-core 2.17.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721217600">- update to 10.2.0:
  Ansible 10.2.0 includes ansible-core 2.17.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 10.3.0:
  Ansible 10.3.0 includes ansible-core 2.17.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 10.4.0:
  Ansible 10.4.0 includes ansible-core 2.17.4 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 10.5.0:
  Ansible 10.5.0 includes ansible-core 2.17.5 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 10.6.0:
  Ansible 10.6.0 includes ansible-core 2.17.6 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 10
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/10/CHANGELOG-v10.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- update to 11.0.0
  Ansible 11.0.0 includes ansible-core 2.18.0 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- introduce next_ansible_core_version to ease updates of
  ansible-core while making sure we keep to the same minor release
  family (2.16.x, 2.17.x, 2.18.x)
- rename ansible-11-rpmlintrc back to ansible-rpmlintrc</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733313600">- update to 11.1.0
  Ansible 11.1.0 includes ansible-core 2.18.1 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738152000">- update to 11.2.0:
  Ansible 11.2.0 includes ansible-core 2.18.2 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 11.3.0:
  Ansible 11.3.0 includes ansible-core 2.18.3 as well as a curated
  set of Ansible collections that provide a vast number of modules
  and plugins.
  Collections which have opted-in to being a part of the Ansible 11
  unified changelog will have an entry on this page:
  https://github.com/ansible-community/ansible-build-data/blob/main/11/CHANGELOG-v11.rst</changelog>
</package>
<package pkgid="7005400805e62ea34bbe6d7961375c56abdd869bf5fe8634f51a982250035239" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.20.1"/>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332, bsc#1174302)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330, bsc#1174145).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753, bsc#1166389).
  * CVE-2020-14365, bsc#1175993: Previously, regardless of the
    disable_gpg_check option, packages were not GPG validated. They
    are now.
- avoid trailing comments after %endif
- Don't Require python-coverage, it is needed only for testing
  (bsc#1177948).</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1712923200">- Address issues where internal templating can cause unsafe
  variables to lose their unsafe designation (bsc#1216854, CVE-2023-5764)
  * breaking_changes:
    assert - Nested templating may result in an inability for the conditional
    to be evaluated. See the porting guide for more information.
- Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002, CVE-2024-0690)
- Added:
  * 0001-Ensure-that-unsafe-is-more-difficult-to-lose-stable-.patch
  * 0002-Ensure-ANSIBLE_NO_LOG-is-respected-CVE-2024-0690-825.patch</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1738756800">- Address issue exposure of Sensitive Information in Ansible Vault Files Due
  to Improper Logging(bsc#1230601, CVE-2024-8775)
- Added:
  * 0003-Preserve-ANSIBLE_NO_LOG-CVE-2024-8775.patch</changelog>
</package>
<package pkgid="50b5ab38bc95ce0df49cb6876cc127e9584d3d7d614e4365e31f2e919643f1e5" name="ansible" arch="src">
  <version epoch="0" ver="2.9.27" rel="150000.1.20.1"/>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332, bsc#1174302)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330, bsc#1174145).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753, bsc#1166389).
  * CVE-2020-14365, bsc#1175993: Previously, regardless of the
    disable_gpg_check option, packages were not GPG validated. They
    are now.
- avoid trailing comments after %endif
- Don't Require python-coverage, it is needed only for testing
  (bsc#1177948).</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1712923200">- Address issues where internal templating can cause unsafe
  variables to lose their unsafe designation (bsc#1216854, CVE-2023-5764)
  * breaking_changes:
    assert - Nested templating may result in an inability for the conditional
    to be evaluated. See the porting guide for more information.
- Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002, CVE-2024-0690)
- Added:
  * 0001-Ensure-that-unsafe-is-more-difficult-to-lose-stable-.patch
  * 0002-Ensure-ANSIBLE_NO_LOG-is-respected-CVE-2024-0690-825.patch</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1738756800">- Address issue exposure of Sensitive Information in Ansible Vault Files Due
  to Improper Logging(bsc#1230601, CVE-2024-8775)
- Added:
  * 0003-Preserve-ANSIBLE_NO_LOG-CVE-2024-8775.patch</changelog>
</package>
<package pkgid="e41daff8cf5fdf8cc8239d53e119e5d4d1fe202d174203e53cc56cc5447d7664" name="ansible-core" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.3.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706616000">- update to 2.16.3:
  https://github.com/ansible/ansible/blob/v2.16.3/changelogs/CHANGELOG-v2.16.rst
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  * Bugfixes
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
</package>
<package pkgid="dc64566e9c7599d741ddcd0fcb55e8d5f2a45481f8e1dc0f0baf2f9e3026cf71" name="ansible-core" arch="src">
  <version epoch="0" ver="2.18.3" rel="150400.9.3.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706616000">- update to 2.16.3:
  https://github.com/ansible/ansible/blob/v2.16.3/changelogs/CHANGELOG-v2.16.rst
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  * Bugfixes
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
</package>
<package pkgid="844062b39db7f415fe02accd011f955a4df6d3ebca6713e0a3ff39fb96d697db" name="ansible-core" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.6.1"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
</package>
<package pkgid="861947dd6c659490aee3d824759c138265bcc168064eb9f2efa625d12fb5feb2" name="ansible-core" arch="src">
  <version epoch="0" ver="2.18.3" rel="150400.9.6.1"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
</package>
<package pkgid="122c53b3c32cafff3c235c4b8a84318a2f9d0d15b5fce1a2b1a6d84dcafd115d" name="ansible-core" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.9.4"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1748260800">- Add patch suse-distribution-fix.patch to fix distribution.py
  to identify the correct distribution for server-sap and micro
  (#PED-12643)</changelog>
</package>
<package pkgid="00d000b9943e93b95e25d111e62ddb1a43fe45533438b760e1e387d74b9e3519" name="ansible-core" arch="src">
  <version epoch="0" ver="2.18.3" rel="150400.9.9.4"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1748260800">- Add patch suse-distribution-fix.patch to fix distribution.py
  to identify the correct distribution for server-sap and micro
  (#PED-12643)</changelog>
</package>
<package pkgid="790e176b17dbf607b1c8b2e91169857c6036d610ed05563e549f612d0ea6021b" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.20.1"/>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332, bsc#1174302)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330, bsc#1174145).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753, bsc#1166389).
  * CVE-2020-14365, bsc#1175993: Previously, regardless of the
    disable_gpg_check option, packages were not GPG validated. They
    are now.
- avoid trailing comments after %endif
- Don't Require python-coverage, it is needed only for testing
  (bsc#1177948).</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1712923200">- Address issues where internal templating can cause unsafe
  variables to lose their unsafe designation (bsc#1216854, CVE-2023-5764)
  * breaking_changes:
    assert - Nested templating may result in an inability for the conditional
    to be evaluated. See the porting guide for more information.
- Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002, CVE-2024-0690)
- Added:
  * 0001-Ensure-that-unsafe-is-more-difficult-to-lose-stable-.patch
  * 0002-Ensure-ANSIBLE_NO_LOG-is-respected-CVE-2024-0690-825.patch</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1738756800">- Address issue exposure of Sensitive Information in Ansible Vault Files Due
  to Improper Logging(bsc#1230601, CVE-2024-8775)
- Added:
  * 0003-Preserve-ANSIBLE_NO_LOG-CVE-2024-8775.patch</changelog>
</package>
<package pkgid="555c9302794b64f0fc93b2bce89aeff2b9603b7a9463012356ec2292bdf6b229" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.3.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1706616000">- update to 2.16.3:
  https://github.com/ansible/ansible/blob/v2.16.3/changelogs/CHANGELOG-v2.16.rst
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  * Bugfixes
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
</package>
<package pkgid="960e3f0d25cc7669b89c61c1346e552fdef60ec7cb898b219e95589af53eaa04" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.6.1"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1710590400">- update to 2.16.4:
  https://github.com/ansible/ansible/blob/v2.16.4/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Fix loading vars_plugins in roles (#82239).
  - expect - fix argument spec error using timeout=null (#80982).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
</package>
<package pkgid="f3b6d62d5620afe4732b53574235564915eddf00a8ca4e74abb5e6447cc9c767" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.18.3" rel="150400.9.9.4"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1711540800">- update to 2.16.5:
  https://github.com/ansible/ansible/blob/v2.16.5/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  * Bugfixes
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1713268800">- adjust spec to new name for PyPI file name (underscore instead of
  hyphen: ansible_core-2.16.6.tar.gz)
- update to 2.16.6:
  https://github.com/ansible/ansible/blob/v2.16.6/changelogs/CHANGELOG-v2.16.rst
  * Bugfixes
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Fix check for missing `_sub_plugin` attribute in older
    connection plugins (#82954)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf5 - replace removed API calls
  - facts - add a generic detection for VMware in product name.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1716465600">- update to 2.16.7:
  https://github.com/ansible/ansible/blob/v2.16.7/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible.builtin.user - Remove user not found warning (#80267)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - ansible-test - Automatically enable the PyPI proxy for the
    centos7 container to restore the ability to use pip in that
    container.
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - uri - update the documentation for follow_redirects.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1718798400">- update to 2.16.8:
  https://github.com/ansible/ansible/blob/v2.16.8/changelogs/CHANGELOG-v2.16.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958400">- update to 2.17.0:
  https://github.com/ansible/ansible/blob/v2.17.0/changelogs/CHANGELOG-v2.17.rst
  * Major Changes
  - urls.py - Removed support for Python 2
  * Minor Changes
  - Add dump and passno mount information to facts component
    (#80478)
  - Added MIRACLE LINUX 9.2 in RedHat OS Family.
  - Interpreter Discovery - Remove hardcoded references to
    specific python interpreters to use for certain distro
    versions, and modify logic for python3 to become the default.
  - Use Python's built-in functools.update_wrapper instead an
    inline copy from Python 3.7.
  - User can now set ansible.log to record higher verbosity than
    what is specified for display via new configuration item
    LOG_VERBOSITY.
  - DEFAULT_PRIVATE_ROLE_VARS is now overridden by explicit
    setting of public for include_roles and import_roles.
  - ansible-galaxy role|collection init - accept --extra-vars to
    supplement/override the variables ansible-galaxy injects for
    templating .j2 files in the skeleton.
  - import_role action now also gets a public option that
    controls variable exports, default depending on
    DEFAULT_PRIVATE_ROLE_VARS (if using defaults equates to
    public=True).
  - added configuration item TARGET_LOG_INFO that allows the
    user/author to add an information string to the log output on
    targets.
  - ansible-doc - treat double newlines in documentation strings
    as paragraph breaks. This is useful to create multi-paragraph
    notes in module/plugin documentation (#82465).
  - ansible-doc output has been revamped to make it more visually
    pleasing when going to a terminal, also more concise, use -v
    to show extra information.
  - ansible-galaxy - Started normalizing build directory with a
    trailing separator when building collections, internally.
    (#81619).
  - ansible-galaxy dependency resolution messages have changed
    the unexplained 'virtual' collection for the specific type
    ('scm', 'dir', etc) that is more user friendly
  - ansible-test - Add Alpine 3.19 container.
  - ansible-test - Add Alpine 3.19 to remotes.
  - ansible-test - Add Fedora 39 container.
  - ansible-test - Add Fedora 39 remote.
  - ansible-test - Add a work-around for permission denied errors
    when using pytest &gt;= 8 on multi-user systems with an
    installed version of ansible-test.
  - ansible-test - Add support for RHEL 9.3 remotes.
  - ansible-test - Added a macOS 14.3 remote VM.
  - ansible-test - Bump the nios-test-container from version
    2.0.0 to version 3.0.0.
  - ansible-test - Containers and remotes managed by ansible-test
    will have their Python EXTERNALLY-MANAGED marker (PEP668)
    removed. This provides backwards compatibility for existing
    tests running in newer environments which mark their Python
    as externally managed. A future version of ansible-test may
    change this behavior, requiring tests to be adapted to such
    environments.
  - ansible-test - Make Python 3.12 the default version used in
    the base and default containers.
  - ansible-test - Remove Alpine 3(.18) container.
  - ansible-test - Remove Alpine 3.18 from remotes.
  - ansible-test - Remove Fedora 38 remote support.
  - ansible-test - Remove Fedora 38 test container.
  - ansible-test - Remove rhel/9.2 test remote
  - ansible-test - Remove the FreeBSD 13.2 remote.
  - ansible-test - Removed fallback to virtualenv when -m venv is
    non-functional.
  - ansible-test - Removed test remotes: macos/13.2
  - ansible-test - Removed the no-basestring sanity test. The
    test is no longer necessary now that Python 3 is required.
  - ansible-test - Removed the no-dict-iteritems,
    no-dict-iterkeys and no-dict-itervalues sanity tests. The
    tests are no longer necessary since Python 3 is required.
  - ansible-test - Removed the no-main-display sanity test. The
    unwanted pattern is unlikely to occur, since the test has
    existed since Ansible 2.8.
  - ansible-test - Removed the no-unicode-literals sanity test.
    The test is unnecessary now that Python 3 is required and the
    unicode_literals feature has no effect.
  - ansible-test - Special handling for installation of
    cryptography has been removed, as it is no longer necessary.
  - ansible-test - The shellcheck sanity test no longer disables
    the SC2164 check. In most cases, seeing this error means the
    script is missing set -e.
  - ansible-test - The unidiomatic-typecheck rule has been
    enabled in the pylint sanity test.
  - ansible-test - The unidiomatic-typecheck rule has been
    removed from the validate-modules sanity test.
  - ansible-test - Update the base and default containers to use
    Ubuntu 22.04 for the base image. This also updates PowerShell
    to version 7.4.0 with .NET 8.0.0 and ShellCheck to version
    0.8.0.
  - ansible-test - Updated the CloudStack test container to
    version 1.7.0.
  - ansible-test - Updated the distro test containers to version
    6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3
    container is now based on 3.18 instead of 3.17 and includes
    Python 3.11 instead of Python 3.10.
  - ansible-test - Updated the distro test containers to version
    7.1.0.
  - ansible-test - When ansible-test installs requirements, it
    now instructs pip to allow installs on externally managed
    environments as defined by PEP 668. This only occurs in
    ephemeral environments managed by ansible-test, such as
    containers, or when the --requirements option is used.
  - ansible-test - When invoking sleep in containers during
    container setup, the env command is used to avoid invoking
    the shell builtin, if present.
  - ansible-test - document block name now included in error
    message for YAML parsing errors (#82353).
  - ansible-test - sanity test allows EXAMPLES to be
    multi-document YAML (#82353).
  - ansible-test now has FreeBSD 13.3 and 14.0 support
  - ansible.builtin.user - Remove user not found warning (#80267)
  - apt_repository.py - use api.launchpad.net endpoint instead of
    launchpad.net/api
  - async tasks can now also support check mode at the same time.
  - async_status now supports check mode.
  - constructed inventory plugin - Adding a note that only
    group_vars of explicit groups are loaded (#82580).
  - csvfile - add a keycol parameter to specify in which column
    to search.
  - dnf - add the best option
  - dnf5 - add the best option
  - filter plugin - Add the count and mandatory_count parameters
    in the regex_replace filter
  - find - add a encoding parameter to specify which encoding of
    the files to be searched.
  - git module - gpg_allowlist name was added in 2.17 and we will
    eventually deprecate the gpg_whitelist alias.
  - import_role - allow subdirectories with `_from` options for
    parity with include_role (#82584).
  - module argument spec - Allow module authors to include
    arbitrary additional context in the argument spec, by making
    use of a new top level key called context. This key should be
    a dict type. This allows for users to customize what they
    place in the argument spec, without having to ignore sanity
    tests that validate the schema.
  - modules - Add the ability for an action plugin to call
    self._execute_module(*, ignore_unknown_opts=True) to execute
    a module with options that may not be supported for the
    version being called. This tells the module basic wrapper to
    ignore validating the options provided match the arg spec.
  - package action now has a configuration that overrides the
    detected package manager, it is still overridden itself by
    the use option.
  - py3compat - Remove ansible.utils.py3compat as it is no longer
    necessary
  - removed the unused argument create_new_password from
    CLI.build_vault_ids (#82066).
  - urls - Add support for TLS 1.3 post handshake certificate
    authentication - #81782
  - urls - reduce complexity of Request.open
  - user - accept yescrypt hash as user password
  - validate-modules tests now correctly handles choices in
    dictionary format.
  * Breaking Changes / Porting Guide
  - assert - Nested templating may result in an inability for the
    conditional to be evaluated. See the porting guide for more
    information.
  * Deprecated Features
  - Old style vars plugins which use the entrypoints
    get_host_vars or get_group_vars are deprecated. The plugin
    should be updated to inherit from BaseVarsPlugin and define a
    get_vars method as the entrypoint.
  - The 'required' parameter in
    'ansible.module_utils.common.process.get_bin_path' API is
    deprecated (#82464).
  - module_utils - importing the following convenience helpers
    from ansible.module_utils.basic has been deprecated:
    get_exception, literal_eval, _literal_eval, datetime, signal,
    types, chain, repeat, PY2, PY3, b, binary_type,
    integer_types, iteritems, string_types, test_type, map and
    shlex_quote.
  - ansible-doc - role entrypoint attributes are deprecated and
    eventually will no longer be shown in ansible-doc from
    ansible-core 2.20 on (#82639, #82678).
  - paramiko connection plugin, configuration items in the global
    scope are being deprecated and will be removed in favor or
    the existing same options in the plugin itself. Users should
    not need to change anything (how to configure them are the
    same) but plugin authors using the global constants should
    move to using the plugin's get_option().
  * Removed Features (previously deprecated)
  - Remove deprecated APIs from ansible-docs (#81716).
  - Remove deprecated JINJA2_NATIVE_WARNING environment variable
    (#81714)
  - Remove deprecated scp_if_ssh from ssh connection plugin
    (#81715).
  - Remove deprecated crypt support from ansible.utils.encrypt
    (#81717)
  - Removed Python 2.7 and Python 3.6 as a supported remote
    version. Python 3.7+ is now required for target execution.
  - With the removal of Python 2 support, the yum module and yum
    action plugin are removed and redirected to dnf.
  * Security Fixes
  - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was
    ignored (CVE-2024-0690)
  - ansible-galaxy - Prevent roles from using symlinks to
    overwrite files outside of the installation directory
    (CVE-2023-5115)
  - templating - Address issues where internal templating can
    cause unsafe variables to lose their unsafe designation
    (CVE-2023-5764)
  * Bugfixes
  - Add a version ceiling constraint for pypsrp to avoid
    potential breaking changes in the 1.0.0 release.
  - All core lookups now use set_option(s) even when doing their
    own custom parsing. This ensures that the options are always
    the proper type.
  - Allow for searching handler subdir for included task via
    include_role (#81722)
  - AnsibleModule.atomic_move - fix preserving extended ACLs of
    the destination when it exists (#72929).
  - Cache host_group_vars after instantiating it once and limit
    the amount of repetitive work it needs to do every time it
    runs.
  - Call PluginLoader.all() once for vars plugins, and load vars
    plugins that run automatically or are enabled specifically by
    name subsequently.
  - Consolidate systemd detection logic into one place (#80975).
  - Consolidated the list of internal static vars, centralized
    them as constant and completed from some missing entries.
  - Do not print undefined error message twice (#78703).
  - Enable file cache for vaulted files during vars lookup to fix
    a strong performance penalty in huge and complex playbboks.
  - Fix NEVRA parsing of package names that include digit(s) in
    them (#76463, #81018)
  - Fix force_handlers not working with any_errors_fatal (#36308)
  - Fix run_once being incorrectly interpreted on handlers
    (#81666)
  - Fix an issue when setting a plugin name from an unsafe source
    resulted in ValueError: unmarshallable object (#82708)
  - Fix check for missing _sub_plugin attribute in older
    connection plugins (#82954)
  - Fix condition for unquoting configuration strings from ini
    files (#82387).
  - Fix for when any_errors_fatal was ignored if error occurred
    in a block with always (#31543)
  - Fix handlers not being executed in lockstep using the linear
    strategy in some cases (#82307)
  - Fix handling missing urls in
    ansible.module_utils.urls.fetch_file for Python 3.
  - Fix issue where an include_tasks handler in a role was not
    able to locate a file in tasks/ when tasks_from was used as a
    role entry point and main.yml was not present (#82241)
  - Fix issues when tasks withing nested blocks wouldn't run when
    force_handlers is set (#81533)
  - Fix loading vars_plugins in roles (#82239).
  - Fix notifying role handlers by listen keyword topics with the
    "role_name : " prefix (#82849).
  - Fix setting proper locale for git executable when running on
    non english systems, ensuring git output can always be
    parsed.
  - Fix tasks in always section not being executed for nested
    blocks with any_errors_fatal (#73246)
  - Fixes permission for cache json file from 600 to 644
    (#82683).
  - Give the tombstone error for include pre-fork like other
    tombstoned action/module plugins.
  - Harden python templates for respawn and ansiballz around str
    literal quoting
  - Include the task location when a module or action plugin is
    deprecated (#82450).
  - Interpreter discovery - Add Amzn to OS_FAMILY_MAP for correct
    family fallback for interpreter discovery (#80882).
  - Mirror the behavior of dnf on the command line when handling
    NEVRAs with omitted epoch (#71808)
  - Plugin loader does not dedupe nor cache filter/test plugins
    by file basename, but full path name.
  - Properly template tags in parent blocks (#81053)
  - Provide additional information about the alternative plugin
    in the deprecation message (#80561).
  - Remove the galaxy_info field platforms from the role
    templates (#82453).
  - Restoring the ability of filters/tests can have same file
    base name but different tests/filters defined inside.
  - Reword the error message when the module fails to parse
    parameters in JSON format (#81188).
  - Reword warning if the reserved keyword _ansible_ used as a
    module parameter (#82514).
  - Run all handlers with the same listen topic, even when
    notified from another handler (#82363).
  - Slight optimization to hostvars (instantiate template only
    once per host, vs per call to var).
  - Stopped misleadingly advertising async mode support in the
    reboot module (#71517).
  - ansible-galaxy role import - fix using the role_name in a
    standalone role's galaxy_info metadata by disabling automatic
    removal of the ansible-role- prefix. This matches the
    behavior of the Galaxy UI which also no longer implicitly
    removes the ansible-role- prefix. Use the --role-name option
    or add a role_name to the galaxy_info dictionary in the
    role's meta/main.yml to use an alternate role name.
  - ansible-test sanity --test runtime-metadata - add
    action_plugin as a valid field for modules in the schema
    (#82562).
  - ansible.module_utils.service - ensure binary data
    transmission in daemonize()
  - any_errors_fatal should fail all hosts and rescue all of them
    when a rescue section is specified (#80981)
  - include_role - properly execute v2_playbook_on_include and
    v2_runner_on_failed callbacks as well as increase ok and
    failed stats in the play recap, when appropriate (#77336)
  - allow_duplicates - fix evaluating if the current role allows
    duplicates instead of using the initial value from the
    duplicate's cached role.
  - ansible-config init will now dedupe ini entries from plugins.
  - ansible-config will now properly template defaults before
    dumping them.
  - ansible-doc - fixed "inicates" typo in output
  - ansible-doc - format top-level descriptions with multiple
    paragraphs as multiple paragraphs, instead of concatenating
    them (#83155).
  - ansible-galaxy - Deprecate use of the Galaxy v2 API (#81781)
  - ansible-galaxy - Provide a better error message when using a
    requirements file with an invalid format - #81901
  - ansible-galaxy - Resolve issue with the dataclass used for
    galaxy.yml manifest caused by using future annotations
  - ansible-galaxy - ensure path to ansible collection when
    installing or downloading doesn't have a backslash (#79705).
  - ansible-galaxy - started allowing the use of pre-releases for
    collections that do not have any stable versions published.
    (#81606)
  - ansible-galaxy - started allowing the use of pre-releases for
    dependencies on any level of the dependency tree that
    specifically demand exact pre-release versions of collections
    and not version ranges. (#81606)
  - ansible-galaxy error on dependency resolution will not error
    itself due to 'virtual' collections not having a
    name/namespace.
  - ansible-galaxy info - fix reporting no role found when
    lookup_role_by_name returns None.
  - ansible-galaxy role import - exit with 1 when the import
    fails (#82175).
  - ansible-galaxy role install - fix installing roles from
    Galaxy that have version None (#81832).
  - ansible-galaxy role install - fix symlinks (#82702, #81965).
  - ansible-galaxy role install - normalize tarfile paths and
    symlinks using ansible.utils.path.unfrackpath and consider
    them valid as long as the realpath is in the tarfile's role
    directory (#81965).
  - ansible-inventory - index available_hosts for major
    performance boost when dumping large inventories
  - ansible-pull now will expand relative paths for the
  - d|--directory option is now expanded before use.
  - ansible-pull will now correctly handle become and connection
    password file options for ansible-playbook.
  - ansible-test - Add a pylint plugin to work around a known
    issue on Python 3.12.
  - ansible-test - Explicitly supply ControlPath=none when
    setting up port forwarding over SSH to address the scenario
    where the local ssh configuration uses ControlPath for all
    hosts, and would prevent ports to be forwarded after the
    initial connection to the host.
  - ansible-test - Fix parsing of cgroup entries which contain a
    : in the path (#81977).
  - ansible-test - Include missing pylint requirements for Python
    3.10.
  - ansible-test - Properly detect docker host when using ssh://
    protocol for connecting to the docker daemon.
  - ansible-test - The libexpat package is automatically upgraded
    during remote bootstrapping to maintain compatibility with
    newer Python packages.
  - ansible-test - The validate-modules sanity test no longer
    attempts to process files with unrecognized extensions as
    Python (resolves #82604).
  - ansible-test - Update pylint to version 3.0.1.
  - ansible-test ansible-doc sanity test - do not remove
    underscores from plugin names in collections before calling
    ansible-doc (#82574).
  - ansible-test validate-modules sanity test - do not treat
    leading underscores for plugin names in collections as an
    attempted deprecation (#82575).
  - ansible-test — Python 3.8–3.12 will use coverage v7.3.2.
  - ansible.builtin.apt - calling clean = true does not properly
    clean certain cache files such as /var/cache/apt/pkgcache.bin
    and /var/cache/apt/pkgcache.bin (#82611)
  - ansible.builtin.uri - the module was ignoring the force
    parameter and always requesting a cached copy (via the
    If-Modified-Since header) when downloading to an existing
    local file. Disable caching when force is true, as documented
    (#82166).
  - ansible_managed restored it's 'templatability' by ensuring
    the possible injection routes are cut off earlier in the
    process.
  - apt - honor install_recommends and dpkg_options while
    installing python3-apt library (#40608).
  - apt - install recommended packages when installing package
    via deb file (#29726).
  - apt_repository - do not modify repo files if the file is a
    symlink (#49809).
  - apt_repository - update PPA URL to point to https URL
    (#82463).
  - assemble - fixed missing parameter 'content' in
    `_get_diff_data` API (#82359).
  - async - Fix bug that stopped running async task in --check
    when check_mode: False was set as a task attribute - #82811
  - blockinfile - when create=true is used with a filename
    without path, the module crashed (#81638).
  - check if there are attributes to set before attempting to set
    them (#76727)
  - copy action now also generates temprary files as hidden ('.'
    prefixed) to avoid accidental pickup by running services that
    glob by extension.
  - copy action now ensures that tempfiles use the same suffix as
    destination, to allow for validate to work with utilities
    that check extensions.
  - deb822_repository - handle idempotency if the order of
    parameters is changed (#82454).
  - debconf - allow user to specify a list for value when vtype
    is multiselect (#81345).
  - delegate_to when set to an empty or undefined variable will
    now give a proper error.
  - distribution.py - Recognize ALP-Dolomite as part of the SUSE
    OS family in Ansible, fixing its previous misidentification
    (#82496).
  - distro - bump bundled distro version from 1.6.0 to 1.8.0
    (#81713).
  - dnf - fix an issue when cached RPMs were left in the cache
    directory even when the keepcache setting was unset (#81954)
  - dnf - fix an issue when installing a package by specifying a
    file it provides could result in installing a different
    package providing the same file than the package already
    installed resulting in resolution failure (#82461)
  - dnf - properly set gpg check options on enabled repositories
    according to the disable_gpg_check option (#80110)
  - dnf - properly skip unavailable packages when skip_broken is
    enabled (#80590)
  - dnf - the nobest option only overrides the distribution
    default when explicitly used, and is used for all supported
    operations (#82616)
  - dnf5 - replace removed API calls
  - dnf5 - respect allow_downgrade when installing packages
    directly from rpm files
  - dnf5 - the nobest option only overrides the distribution
    default when used
  - dwim functions for lookups should be better at detectging
    role context even in abscense of tasks/main.
  - ensure we have logger before we log when we have increased
    verbosity.
  - expect - fix argument spec error using timeout=null (#80982).
  - fact gathering on linux now handles thread count by using
    rounding vs dropping decimals, it should give slightly more
    accurate numbers.
  - facts - add a generic detection for VMware in product name.
  - facts - detect VMware ESXi 8.0 virtualization by product name
    VMware20,1
  - fetch - Do not calculate the file size for Windows fetch
    targets to improve performance.
  - fetch - add error message when using dest with a trailing
    slash that becomes a local directory - #82878
  - find - do not fail on Permission errors (#82027).
  - first_found lookup now always returns a full (absolute) and
    normalized path
  - first_found lookup now always takes into account k=v options
  - flush_handlers - properly handle a handler failure in a
    nested block when force_handlers is set
    (http://github.com/ansible/ansible/issues/81532)
  - galaxy - skip verification for unwanted Python compiled
    bytecode files (#81628).
  - handle exception raised while validating with elements='int'
    and value is not within choices (#82776).
  - include_tasks - include ansible_loop_var and
    ansible_index_var in a loop (#82655).
  - include_vars - fix calculating depth relative to the root and
    ensure all files are included (#80987).
  - interpreter_discovery - handle AnsibleError exception raised
    while interpreter discovery (#78264).
  - iptables - add option choices 'src,src' and 'dst,dst' in
    match_set_flags (#81281).
  - iptables - set jump to DSCP when set_dscp_mark or
    set_dscp_mark_class is set (#77077).
  - known_hosts - Fix issue with @cert-authority entries in
    known_hosts incorrectly being removed.
  - module no_log will no longer affect top level booleans, for
    example no_log_module_parameter='a' will no longer hide
    changed=False as a 'no log value' (matches 'a').
  - moved assemble, raw, copy, fetch, reboot, script and
    wait_for_connection to query task instead of play_context
    ensuring they get the lastest and most correct data.
  - reboot action now handles connections with 'timeout' vs only
    'connection_timeout' settings.
  - role params now have higher precedence than host facts again,
    matching documentation, this had unintentionally changed in
    2.15.
  - roles, code cleanup and performance optimization of
    dependencies, now cached, and public setting is now
    determined once, at role instantiation.
  - roles, the static property is now correctly set, this will
    fix issues with public and DEFAULT_PRIVATE_ROLE_VARS controls
    on exporting vars.
  - set_option method for plugins to update config now properly
    passes through type casting and validation.
  - ssh - add tests for the SSH connection plugin.
  - support url-encoded credentials in URLs like
    http://x%40:%40@example.com (#82552)
  - syslog - Handle ValueError exception raised when sending Null
    Characters to syslog with Python 3.12.
  - systemd_services - update documentation regarding
    required_one_of and required_by parameters (#82914).
  - template - Fix error when templating an unsafe string which
    corresponds to an invalid type in Python (#82600).
  - template action will also inherit the behavior from copy (as
    it uses it internally).
  - templating - ensure syntax errors originating from a template
    being compiled into Python code object result in a failure
    (#82606)
  - unarchive - add support for 8 character permission strings
    for zip archives (#81705).
  - unarchive - force unarchive if symlink target changes
    (#30420).
  - unarchive modules now uses zipinfo options without relying on
    implementation defaults, making it more compatible with all
    OS/distributions.
  - unsafe data - Address an incompatibility when iterating or
    getting a single index from AnsibleUnsafeBytes
  - unsafe data - Address an incompatibility with
    AnsibleUnsafeText and AnsibleUnsafeBytes when pickling with
    protocol=0
  - unsafe data - Enable directly using AnsibleUnsafeText with
    Python pathlib (#82414)
  - uri - update the documentation for follow_redirects.
  - uri action plugin now skipped during check mode (not
    supported) instead of even trying to execute the module,
    which already skipped, this does not really change the
    result, but returns much faster.
  - vars - handle exception while combining VarsWithSources and
    dict (#81659).
  - wait_for should not handle 'non mmapable files' again.
  - winrm - Better handle send input failures when communicating
    with hosts under load
  - winrm - Do not raise another exception during cleanup when a
    task is timed out - #81095
  - winrm - does not hang when attempting to get process output
    when stdin write failed</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720958401">- update to 2.17.1:
  https://github.com/ansible/ansible/blob/v2.17.1/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Update pypi-test-container to version 3.1.0.
  * Bugfixes
  - Fix rapid memory usage growth when notifying handlers using
    the listen keyword (#83392)
  - Fix the task attribute resolved_action to show the FQCN
    instead of None when action or local_action is used in the
    playbook.
  - Fix using module_defaults with local_action/action (#81905).
  - fixed unit test test_borken_cowsay to address mock not been
    properly applied when existing unix system already have
    cowsay installed.
  - powershell - Implement more robust deletion mechanism for C#
    code compilation temporary files. This should avoid scenarios
    where the underlying temporary directory may be temporarily
    locked by antivirus tools or other IO problems. A failure to
    delete one of these temporary directories will result in a
    warning rather than an outright failure.
  - shell plugin - properly quote all needed components of shell
    commands (#82535)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131200">- update to 2.17.2:
  https://github.com/ansible/ansible/blob/v2.17.2/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix a traceback when an environment variable contains certain
    special characters (#83498)
  - dnf - reverted incomplete fix from 2.17.2rc1 (#83504)
  - dnf, dnf5 - fix for installing a set of packages by
    specifying them using a wildcard character (#83373)
  - linear strategy now provides a properly templated task name
    to the v2_runner_on_started callback event.
  - package_facts - ignore warnings sent by apk on stderr
    (#83501).
  - replace - Updated before/after example (#83390).
  - templating hostvars under native jinja will not cause
    serialization errors anymore.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1723550400">- update to 2.17.3:
  https://github.com/ansible/ansible/blob/v2.17.3/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve the error message shown when an
    unknown --remote or --docker option is given.
  - ansible-test - Removed the vyos/1.1.8 network remote as it is
    no longer functional.
  * Bugfixes
  - Warning now includes filename and line number of variable
    when specifying a list of dictionaries for vars (#82528).
  - config, restored the ability to set module compression via a
    variable
  - debconf - fix normalization of value representation for
    boolean vtypes in new packages (#83594)
  - linear strategy: fix handlers included via include_tasks
    handler to be executed in lockstep (#83019)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726056000">- update to 2.17.4:
  https://github.com/ansible/ansible/blob/v2.17.4/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Fix SemanticVersion.parse() to store the version string so
    that __repr__ reports it instead of None (#83831).
  - Fix an issue where registered variable was not available for
    templating in loop_control.label on skipped looped tasks
    (#83619)
  - Fix for meta tasks breaking host/fork affinity with
    host_pinned strategy (#83294)
  - Fix using the current task's directory for looking up
    relative paths within roles (#82695).
  - atomic_move - fix using the setgid bit on the parent
    directory when creating files (#46742, #67177).
  - connection plugins using the 'extras' option feature would
    need variables to match the plugin's loaded name, sometimes
    requiring fqcn, which is not the same as the
    documented/declared/expected variables. Now we fall back to
    the 'basename' of the fqcn, but plugin authors can still set
    the expected value directly.
  - csvfile lookup - give an error when no search term is
    provided using modern config syntax (#83689).
  - include_tasks - Display location when attempting to load a
    task list where include_* did not specify any value - #83874
  - powershell - Improve CLIXML decoding to decode all control
    characters and unicode characters that are encoded as
    surrogate pairs.
  - psrp - Fix bug when attempting to fetch a file path that
    contains special glob characters like []
  - runtime-metadata sanity test - do not crash on deprecations
    if galaxy.yml contains an empty version field (#83831).
  - ssh - Fix bug when attempting to fetch a file path with
    characters that should be quoted when using the piped
    transfer method</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728648000">- update to 2.17.5:
  https://github.com/ansible/ansible/blob/v2.17.5/changelogs/CHANGELOG-v2.17.rst
  * Bugfixes
  - Add descriptions for ansible-galaxy install --help` and
    ``ansible-galaxy role|collection install --help.
  - Errors now preserve stacked error messages even when YAML is
    involved.
  - ansible-galaxy install --help - Fix the usage text and
    document that the requirements file passed to -r can include
    collections and roles.
  - copy - mtime/atime not updated. Fix now update
    mtime/atime(#83013)
  - delay keyword is now a float, matching the underlying 'time'
    API and user expectations.
  - dnf5 - re-introduce the state: installed alias to state:
    present (#83960)
  - module_utils atomic_move (used by most file based modules),
    now correctly handles permission copy and setting mtime
    correctly across all paths</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1731585600">- update to 2.17.6:
  https://github.com/ansible/ansible/blob/v2.17.6/changelogs/CHANGELOG-v2.17.rst
  * Minor Changes
  - ansible-test - Improve container runtime probe error
    handling. When unexpected probe output is encountered, an
    error with more useful debugging information is provided.
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Bugfixes
  - Fix disabling SSL verification when installing collections
    and roles from git repositories. If --ignore-certs isn't
    provided, the value for the GALAXY_IGNORE_CERTS configuration
    option will be used (#83326).
  - Improve performance on large inventories by reducing the
    number of implicit meta tasks.
  - Use the requested error message in the
    ansible.module_utils.facts.timeout timeout function instead
    of hardcoding one.
  - ansible-test - Enable the sys.unraisablehook work-around for
    the pylint sanity test on Python 3.11. Previously the
    work-around was only enabled for Python 3.12 and later.
    However, the same issue has been discovered on Python 3.11.
  - debconf - set empty password values (#83214).
  - facts - skip if distribution file path is directory, instead
    of raising error (#84006).
  - user action will now require O(force) to overwrite the public
    part of an ssh key when generating ssh keys, as was already
    the case for the private part.
  - user module now avoids changing ownership of files symlinked
    in provided home dir skeleton</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1732190400">- Added necessary test dependencies: pytest-xdist, pytest-mock,
  pytz, passlib, git-core, and openssh to ensure proper test
  execution.
- Introduced the `ansible_python_version` variable and updated the
  test command.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Backport patch to relax resolvelib dependency:
  771f7ad29ca4d259761eaa88673c2e32f6412bbe.patch</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732968000">- update to 2.18.0:
  * Breaking Changes / Porting Guide
  - Stopped wrapping all commands sent over SSH on a Windows
    target with a powershell.exe executable. This results in one
    less process being started on each command for Windows to
    improve efficiency, simplify the code, and make raw an actual
    raw command run with the default shell configured on the
    Windows sshd settings. This should have no affect on most
    tasks except for raw which now is not guaranteed to always be
    running in a PowerShell shell and from having the console
    output codepage set to UTF-8. To avoid this issue either swap
    to using ansible.windows.win_command,
    ansible.windows.win_shell, ansible.windows.win_powershell or
    manually wrap the raw command with the shell commands needed
    to set the output console encoding.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect.
  * Deprecated Features
  - Deprecate ansible.module_utils.basic.AnsibleModule.safe_eval
    and ansible.module_utils.common.safe_eval as they are no
    longer used.
  - persistent connection plugins - The ANSIBLE_CONNECTION_PATH
    config option no longer has any effect, and will be removed
    in a future release.
  - yum_repository - deprecate async option as it has been
    removed in RHEL 8 and will be removed in ansible-core 2.22.
  - yum_repository - the following options are deprecated:
    deltarpm_metadata_percentage, gpgcakey, http_caching,
    keepalive, metadata_expire_filter, mirrorlist_expire,
    protect, ssl_check_cert_permissions, ui_repoid_vars as they
    have no effect for dnf as an underlying package manager. The
    options will be removed in ansible-core 2.22.
  * Removed Features (previously deprecated)
  - Play - removed deprecated ROLE_CACHE property in favor of
    role_cache.
  - Remove deprecated VariableManager._get_delegated_vars method
    (#82950)
  - Removed Python 3.10 as a supported version on the controller.
    Python 3.11 or newer is required.
  - Removed support for setting the vars keyword to lists of
    dictionaries. It is now required to be a single dictionary.
  - loader - remove deprecated non-inclusive words (#82947).
  - paramiko_ssh - removed deprecated ssh_args from the
    paramiko_ssh connection plugin (#82939).
  - paramiko_ssh - removed deprecated ssh_common_args from the
    paramiko_ssh connection plugin (#82940).
  - paramiko_ssh - removed deprecated ssh_extra_args from the
    paramiko_ssh connection plugin (#82941).
  - play_context - remove deprecated PlayContext.verbosity
    property (#82945).
  - utils/listify - remove deprecated 'loader' argument from
    listify_lookup_plugin_terms API (#82949).
  * Security Fixes
  - include_vars action - Ensure that result masking is correctly
    requested when vault-encrypted files are read.
    (CVE-2024-8775)
  - task result processing - Ensure that action-sourced result
    masking (_ansible_no_log=True) is preserved. (CVE-2024-8775)
  - user action won't allow ssh-keygen, chown and chmod to run on
    existing ssh public key file, avoiding traversal on existing
    symlinks (CVE-2024-9902).
  * Known Issues
  - ansible-test - When using ansible-test containers with Podman
    on a Ubuntu 24.04 host, ansible-test must be run as a
    non-root user to avoid permission issues caused by AppArmor.
  - ansible-test - When using the Fedora 40 container with Podman
    on a Ubuntu 24.04 host, the unix-chkpwd AppArmor profile must
    be disabled on the host to allow SSH connections to the
    container.
  * New Plugins
  - timedout - did the task time out
  - vaulted_file - Is this file an encrypted vault
  * New Modules
  - ansible.modules
  - mount_facts - Retrieve mount information.
  * Bugfixes
    Please see the full changelog:
    https://github.com/ansible/ansible/blob/v2.18.0/changelogs/CHANGELOG-v2.18.rst</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- update to 2.18.1:
  * Minor Changes
  - ansible-test - When detection of the current container
    network fails, a warning is now issued and execution
    continues. This simplifies usage in cases where the current
    container cannot be inspected, such as when running in GitHub
    Codespaces.
  * Security Fixes
  - Templating will not prefer AnsibleUnsafe when a variable is
    referenced via hostvars - CVE-2024-11079
  * Bugfixes
  - Fix returning 'unreachable' for the overall task result. This
    prevents false positives when a looped task has unignored
    unreachable items (#84019).
  - ansible-test - Fix traceback that occurs after an interactive
    command fails.
  - dnf5 - fix installing a package using state=latest when a
    binary of the same name as the package is already installed
    (#84259)
  - dnf5 - matching on a binary can be achieved only by
    specifying a full path (#84334)
  - runas become - Fix up become logic to still get the SYSTEM
    token with the most privileges when running as SYSTEM.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738065600">- update to 2.18.2:
  * Bugfixes
  - Ansible will now also warn when reserved keywords are set via
    a module (set_fact, include_vars, etc).
  - Ansible.Basic - Fix required_if check when the option value
    to check is unset or set to null.
  - Use consistent multiprocessing context for action write locks
  - ansible-test - Fix up coverage reporting to properly
    translate the temporary path of integration test modules to
    the expected static test module path.
  - ansible-vault will now correctly handle --prompt, previously
    it would issue an error about stdin if no 2nd argument was
    passed
  - copy action now prevents user from setting internal options.
  - gather_facts action now defaults to ansible.legacy.setup if
    smart was set, no network OS was found and no other alias for
    setup was present.
  - gather_facts action will now issues errors and warnings as
    appropriate if a network OS is detected but no facts modules
    are defined for it.
  - ssh - Improve the logic for parsing CLIXML data in stderr
    when working with Windows host. This fixes issues when the
    raw stderr contains invalid UTF-8 byte sequences and improves
    embedded CLIXML sequences.
  - ssh - connection options were incorrectly templated during
    reset_connection tasks (#84238).</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1740484800">- update to 2.18.3:
  * Minor Changes
  - ansible-test - Automatically retry HTTP GET/PUT/DELETE
    requests on exceptions.
  - ansible-test - Use Python's urllib instead of curl for HTTP
    requests.
  * Bugfixes
  - include_vars - fixed erroneous warning if an unreserved
    variable name contains a single character that matches a
    reserved variable. (#84623)
  - linear strategy - fix executing end_role meta tasks for each
    host, instead of handling these as implicit run_once tasks
    (#84660).</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1741348800">- Add patch unarchive-test-fix.patch for unarchive: Clamp zip
  timestamps on 32-bit time_t. (#84409)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1747656000">- Add missing dependency on python311-rpm required by package_facts
  (#1243193)</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1748260800">- Add patch suse-distribution-fix.patch to fix distribution.py
  to identify the correct distribution for server-sap and micro
  (#PED-12643)</changelog>
</package>
<package pkgid="6df4c2c49d94d9a67d858e9b0fd3287b5250d32ed2ab5b7622c2c90a8511ad91" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.27" rel="150000.1.20.1"/>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332, bsc#1174302)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330, bsc#1174145).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753, bsc#1166389).
  * CVE-2020-14365, bsc#1175993: Previously, regardless of the
    disable_gpg_check option, packages were not GPG validated. They
    are now.
- avoid trailing comments after %endif
- Don't Require python-coverage, it is needed only for testing
  (bsc#1177948).</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes
  * CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  * CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  * CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  * CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1639483200">- Require python macros for building</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232000">- Update to 2.9.22:
  * CVE-2021-3447 (bsc#1183684) multiple modules expose secured values</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1658232001">- Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  * bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive
    info in traceback error message (in 2.9.27)
  * bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line
    strings with ansible facts used in template. (in 2.9.23)
  * bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in
    ansible 2.9.13 (in 2.9.15)</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1712923200">- Address issues where internal templating can cause unsafe
  variables to lose their unsafe designation (bsc#1216854, CVE-2023-5764)
  * breaking_changes:
    assert - Nested templating may result in an inability for the conditional
    to be evaluated. See the porting guide for more information.
- Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002, CVE-2024-0690)
- Added:
  * 0001-Ensure-that-unsafe-is-more-difficult-to-lose-stable-.patch
  * 0002-Ensure-ANSIBLE_NO_LOG-is-respected-CVE-2024-0690-825.patch</changelog>
  <changelog author="harshvardhan.sharma@suse.com" date="1738756800">- Address issue exposure of Sensitive Information in Ansible Vault Files Due
  to Improper Logging(bsc#1230601, CVE-2024-8775)
- Added:
  * 0003-Preserve-ANSIBLE_NO_LOG-CVE-2024-8775.patch</changelog>
</package>
<package pkgid="f5acb4333f9ba4435a4bf2cbb6b582100947dacf644039f386f96b9329fdea67" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="817a720836b054e4e80197e7fd409b929d5586f820e3261ad13965ecad0fb610" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b9882032a89398ccc435ea3f2cc5f383f3806e1488d54ed165d5db3e8e96c8c4" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0d40ab369f898d2ac65d3251096b037f1b98b59f4b119999a43e0e09f3c1b789" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="1a97373c1c9d3facd0b58860a6fa1d173fba2957fcabcb5aa8c5c2f249ea7d9f" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f66b1883ac47296f7edd4b822d09abb2362a58cc0bca086a9b0d4bec85459976" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="388ecc48785ae0549dac96f85df3a31f178b1ae12f8f7d36ec1c7ae80360208c" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="ac8fffaa3fd6850772ec7a4dc2144949972ce6fe39725b24afcc0a8610e0c4d9" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="9675fd504ca9496ad7e9ef51f95a51264e621f86761d210e3fbb15ec400b3788" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="680f37ebf9ba30abb395a5231813435c227dd7cdeb1c1e630517c9268c3b6ecb" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="71e3b4f01d8302672600056fac0ff43772696f015ee01e88800bfa5bb4da686f" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="3e6a9f011f07ca50b3416e350c190be0dd1229a9f7fc0a3ccdbd8c388e63d49b" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="368be49745f104d29e59b49c88323c7be2b26d9aa17dc77aa36971c512a9ff14" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="a0a923e2540c0cb9d64987086bdd42fee4565f80cb4cb43986460e99ec9a4df2" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3c81786fc6c55af109af9f5c839e4efa9f3cee0d2c001fdbbb43230f6a17e921" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="9e0b4d0496a46609dacba151e352c100f10e18cb7fdc84f65a7b2df1896abf70" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f85184bd1ca83900e99a0159ae3273580b4598e08dfd16227bd8b39a6dca2869" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f318cacb16377b368dc6a4c8479b1ab8f7581f1eca7c82301e38a5a529befb9c" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="52309cbbca2e73fcf8744d90e8fc3e9415075f768191804e5cc2aa81e86b7896" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b3d5ddbdff5372afbd41701a026252cfc19463bfd2f7bbd439048ae5292986ce" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="7da998f26ff5924ba7977be930b7d6a57420c58a771b04dbd0a74f6f4a43f228" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="02fa94681c51f34d1b90d1e28e2f2a3c718f9b9c54b1899ea26833b2065a2380" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="35382fd3d9e6ad3b4d30e77f57b032c858fa281d48e3a836841ef9b2b92049df" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="899c1c84e5088d42f3f1ce045d0ee2ae3d06bd7d5978c86f65d32d72f7d9bc64" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6a3e5bb99604d1d2549fdfc3fb64a685ffadab5ddb151621733accf52f3ec921" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5ba609a561e03a0b1b08028a29432825ff7085eb2e2277b7e35c0f377755aec6" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc5f9d14a3c79ca97a51ebb4b9a6ab48d1cc9adf811f9de5f96342f0a873988" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="56226ce87d5700d02788ca8d40c448124b02274d766113ae607b6a1d9d2f13ca" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="be421c463f56b84178154364f72725daea51071bafd8cbbf04c3b1feb9c493bc" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="734bc8cb91d7d53872c268781bd344ab1a844df4ea6889987a3b3e370c6e2b95" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc12591a5ecd2d7eed791a024d6d4542fd07a1b392a937ff577ec99f8699a15" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="bda0a2f2307a920719fbe2ea909fe35b1ae115113ff45c7c1da709a4e5ece9c9" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6179b5bc9a84f59bb6eebd4bb1c653b57390c2d6e7da0ecd7ca06fbdd3d5ff33" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="6621f290d1de04c58f9052d9fc11ff44a4a4c45709e00f8e7ac3d3279a083071" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="8650ca83dac1c6e98b14778f4b1e80da0c68d59dab38b19ed6f2a2625fc18750" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="092bc1cf0a5cb899e517f479f2e754616e3295c2c9ef799f6c01efe42e342eb8" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="120d168cb500b0c10dbd858a5598eca680d6655a7d8ce7eac189a25e9e43c063" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8fbb1732d45341675fd4e280dc837c6471e6097f75e97755d64611301ac80881" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="de561ed662bbe9a4b0c6c2a0c776a5f609304ddd2815f32d4fe9059fb06a8d99" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="be23b6e110d357905214d8c5679a352c3a3405c09ce78b30e68eea4ba21f3493" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f5fce8da1c8b1de35aecb37313ec2e76c147fd20935038f1bedcc6aba0517688" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f99e6f074de983ad70babcd752e0ac1bc3153ce65821e375a2f89e3163198c11" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0b6feffb53325df3e9b21520964a1c2f0bd96322e893fd44a7c07887ce99512f" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="273c0417a7d5389c8db27a9fe7bb54026788dfe6cd971ddafae0d3f97f144e59" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="35454e30dcd36741439151137383f427509bec9fecf061cba6ab281264f7109d" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6558fa5ce673952c914bd452a04f475780f8cb30885c879a422287d672e3348f" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f610bd3257fc3d48f856d22237487660624e4df6fa53eb2c088830a7320f9a1a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="63b66becbacc143f8c26f85376ba405fc88eac2a67ae56fb39af6af2650bc49a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3b2195c79c9090ff69f57495ffaae2e7d676e50b1aee3117136478d04f764492" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="c1df7692eca1703c8dce1afe8773e67a0b795b436bc8ee194976fec26e00a2ec" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="5f191773d5849d059b32eb6d338a2729a40bf2c06d63606fe162bb7958eb865f" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="439ee0c9ce3e48865f81400ce35e1b467da890d91fd750f83a089737b710b934" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="cc8ab96f7397814a3908ee5ff25ae406de7ccb9dd3f9706a94c140d645b06543" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5582a1c53e2b452ccb77dc1232caadbef1fd47ef6bb5fe60490da51618dfc8d5" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="eb1138642cd6442cdf7436ce80b27151af201676ee27b8e66f65edd5bf419096" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8262dff4d80daf4e595ba6875fce058d652cd7b7237de289a118673ce99802eb" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="07062ac75e044b6eddc3bbb0cfff3a18a052bd2f6c81d46d6cf95b8b2db1bf66" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="7f481230165fc83a77c68696c9582eb52009f9a0bf7c165becacb71a043b285a" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="638e4c73fdc5d4980a285accdb89d1d2682e31700e0a01be5fa3223fab971fb9" name="aom-tools" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="3df6b07cf2a833fdcdac2fe0c4bf3953e2c9bdc2b2933a9300882758d6bec87b" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="d7b65c744bb160044497616ba1371c3dd658d3b469f2ed1e660d962c37a2a2ad" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="3.7.1" rel="150600.3.5.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="1edbfe5e4439bbb66222db12ed338e49af707cb011db8346696a1857c705f504" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="3.7.1" rel="150600.3.5.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="7b1eb6919fbb20b7badc1adecb8d80f6b62acdfc6e4b2d0ccb446fc743fca26e" name="aom-tools" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="150600.3.5.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="83aeddf229ff6c270b9ed645d76d7e00fffd37adf4b70d8360b9f883d78ac5f4" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="3.7.1" rel="150600.3.5.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="1a1c5ffa6012bc0e5e88c10116235f036edf319c5508caf58e201b3fb9590946" name="apache-commons-beanutils" arch="noarch">
  <version epoch="0" ver="1.11.0" rel="150200.3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537444800">- Updated to 1.9.3
  * This is a bug fix release, which also improves the tests for
    building on Java 8.
  * Note that Java 8 and later no longer support indexed bean
    properties on java.util.List, only on arrays like String[].
    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()
    and PropertyUtils.getPropertyDescriptor(); their javadoc have
    therefore been updated to reflect this change in the JDK.
  * Changes in this version include:
  - Fixed Bugs:
  * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector
  * BEANUTILS-492: Fixed exception when setting indexed properties
    on DynaBeans.
  * BEANUTILS-470: Precision lost when converting BigDecimal.
  * BEANUTILS-465: Indexed List Setters fixed.
  - Changes:
  * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.
  * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.
  * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the
    same naming algorithm as DefaultBeanIntrospector.
  * BEANUTILS-490: Update Java requirement from Java 5 to 6.
  * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2
    (CVE-2015-4852).
  * BEANUTILS-490: Update java requirement to Java 6.
  * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.
  * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.
  * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.
  - Historical list of changes:
    http://commons.apache.org/proper/commons-beanutils/changes-report.html
- Refreshed patch jdk9.patch for this version update</changelog>
  <changelog author="tchvatal@suse.com" date="1537531200">- Fix the Source URLs to use mirrors properly</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Cleanup the maven pom files installation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566388800">- Update to 1.9.4
  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114
- Security fix: [bsc#1146657, CVE-2019-10086]
  * PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
    level property access by default, thus protecting against CVE-2014-0114.
- Fix build version in build.xml
  * Added apache-commons-beanutils-fix-build-version.patch</changelog>
  <changelog author="fstrba@suse.com" date="1570104000">- Remove reference to parent pom, since it is not needed when not
  building with maven</changelog>
  <changelog author="fstrba@suse.com" date="1570449600">- Add aliases to account for the ephemeral commons-beanutils-core
  and commons-beanutils-bean-collections split.</changelog>
  <changelog author="fstrba@suse.com" date="1698753600">- Clean and simplify the spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1708603200">- Fix build with SLE12</changelog>
  <changelog author="gus.kenion@suse.com" date="1743163200">- Update to 1.10.1
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency
    issue (backport to 1.X) #325.
    + Javadoc is missing its Overview page.
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + Deprecate BeanUtils.BeanUtils().
    + Deprecate ConstructorUtils.ConstructorUtils().
    + Deprecate LocaleBeanUtils.LocaleBeanUtils().
    + Deprecate LocaleConvertUtils.LocaleConvertUtils().
    + Deprecate ConvertUtils.ConvertUtils().
    + Deprecate MethodUtils.MethodUtils().
    + Deprecate PropertyUtils.PropertyUtils().
  * Changes:
    + Bump org.apache.commons:commons-parent from 78 to 81.
- Includes changes from 1.10.0
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches
    corrupted writeMethod (1.x backport) #69.
    + Replace internal use of Locale.ENGLISH with Locale.ROOT.
    + Replace Maven CLIRR plugin with JApiCmp.
    + Port to Java 1.4 Throwable APIs (!).
    + Fix Javadoc generation on Java 8, 17, and 21.
    + AbstractArrayConverter.parseElements(String) now returns a
    List&lt;String&gt; instead of a raw List.
  * Changes:
    + Bump org.apache.commons:commons-parent from 47 to 78.
    + Bump Java requirement from Java 6 to 8.
    + Bump junit:junit from 4.12 to 4.13.2.
    + Bump JUnit from 4.x to 5.x "vintage".
    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.
    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
    + Deprecate BeanUtils.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
- Update apache-commons-beanutils-fix-build-version.patch to
  reflect new version.</changelog>
  <changelog author="fstrba@suse.com" date="1748520000">- Update to 1.11.0
  * Fixed Bugs:
    + BeanComparator.compare(T, T) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    all cases of ReflectiveOperationException.
    + MappedMethodReference.get() now throws IllegalStateException
    instead of RuntimeException to wrap cases of
    NoSuchMethodException.
    + ResultSetIterator.get(String) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.hasNext() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.next() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.set(String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.set(String, String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
  * Changes:
    + Add org.apache.commons.beanutils
    .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.
    Fixes bsc#1243793, CVE-2025-48734
    + Bump org.apache.commons:commons-parent from 81 to 84.
    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.
- Modified patch:
  * apache-commons-beanutils-fix-build-version.patch
    + make more generic and pass the version from command-line</changelog>
</package>
<package pkgid="8d1ebebae83df1e767cea4a482a62bc39c652d697927221c9d43b13c76412d2e" name="apache-commons-beanutils" arch="src">
  <version epoch="0" ver="1.11.0" rel="150200.3.9.1"/>
  <changelog author="jsmeix@suse.de" date="1122465600">- Adjustments in the spec file.</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="skh@suse.de" date="1159185600">- don't use icecream
- use source="1.4" and target="1.4" for build with java 1.5</changelog>
  <changelog author="mvyskocil@suse.cz" date="1333368000">- update to 1.8.3 and rename to apache- to follow the upstream
- fixes in this release
  * memory leak in jdk5/jdk6 BEANUTILS-291, BEANUTILS-366
  * BEANUTILS-373 MethodUtils is not thread safe because WeakFastHashMap which
    uses WeakHashMap is not thread-safe
  * [BEANUTILS-371] Add constructors which have useColumnLabel parameter to
    ResultSetDynaClass and RowSetDynaClass
  * and a lot of other like NPE in BeanUtilsBean.setProperty()</changelog>
  <changelog author="dmacvicar@suse.de" date="1404734400">- update to 1.9.2
- CVE-2014-3540:
  'class' property is exposed, potentially leading to RCE (bnc#885963)
- for full changelog, see
  * http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.0/RELEASE-NOTES.txt
  * http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.1/RELEASE-NOTES.txt
  * http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup bit with spec-cleaner</changelog>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537444800">- Updated to 1.9.3
  * This is a bug fix release, which also improves the tests for
    building on Java 8.
  * Note that Java 8 and later no longer support indexed bean
    properties on java.util.List, only on arrays like String[].
    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()
    and PropertyUtils.getPropertyDescriptor(); their javadoc have
    therefore been updated to reflect this change in the JDK.
  * Changes in this version include:
  - Fixed Bugs:
  * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector
  * BEANUTILS-492: Fixed exception when setting indexed properties
    on DynaBeans.
  * BEANUTILS-470: Precision lost when converting BigDecimal.
  * BEANUTILS-465: Indexed List Setters fixed.
  - Changes:
  * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.
  * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.
  * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the
    same naming algorithm as DefaultBeanIntrospector.
  * BEANUTILS-490: Update Java requirement from Java 5 to 6.
  * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2
    (CVE-2015-4852).
  * BEANUTILS-490: Update java requirement to Java 6.
  * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.
  * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.
  * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.
  - Historical list of changes:
    http://commons.apache.org/proper/commons-beanutils/changes-report.html
- Refreshed patch jdk9.patch for this version update</changelog>
  <changelog author="tchvatal@suse.com" date="1537531200">- Fix the Source URLs to use mirrors properly</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Cleanup the maven pom files installation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566388800">- Update to 1.9.4
  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114
- Security fix: [bsc#1146657, CVE-2019-10086]
  * PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
    level property access by default, thus protecting against CVE-2014-0114.
- Fix build version in build.xml
  * Added apache-commons-beanutils-fix-build-version.patch</changelog>
  <changelog author="fstrba@suse.com" date="1570104000">- Remove reference to parent pom, since it is not needed when not
  building with maven</changelog>
  <changelog author="fstrba@suse.com" date="1570449600">- Add aliases to account for the ephemeral commons-beanutils-core
  and commons-beanutils-bean-collections split.</changelog>
  <changelog author="fstrba@suse.com" date="1698753600">- Clean and simplify the spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1708603200">- Fix build with SLE12</changelog>
  <changelog author="gus.kenion@suse.com" date="1743163200">- Update to 1.10.1
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency
    issue (backport to 1.X) #325.
    + Javadoc is missing its Overview page.
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + Deprecate BeanUtils.BeanUtils().
    + Deprecate ConstructorUtils.ConstructorUtils().
    + Deprecate LocaleBeanUtils.LocaleBeanUtils().
    + Deprecate LocaleConvertUtils.LocaleConvertUtils().
    + Deprecate ConvertUtils.ConvertUtils().
    + Deprecate MethodUtils.MethodUtils().
    + Deprecate PropertyUtils.PropertyUtils().
  * Changes:
    + Bump org.apache.commons:commons-parent from 78 to 81.
- Includes changes from 1.10.0
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches
    corrupted writeMethod (1.x backport) #69.
    + Replace internal use of Locale.ENGLISH with Locale.ROOT.
    + Replace Maven CLIRR plugin with JApiCmp.
    + Port to Java 1.4 Throwable APIs (!).
    + Fix Javadoc generation on Java 8, 17, and 21.
    + AbstractArrayConverter.parseElements(String) now returns a
    List&lt;String&gt; instead of a raw List.
  * Changes:
    + Bump org.apache.commons:commons-parent from 47 to 78.
    + Bump Java requirement from Java 6 to 8.
    + Bump junit:junit from 4.12 to 4.13.2.
    + Bump JUnit from 4.x to 5.x "vintage".
    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.
    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
    + Deprecate BeanUtils.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
- Update apache-commons-beanutils-fix-build-version.patch to
  reflect new version.</changelog>
  <changelog author="fstrba@suse.com" date="1748520000">- Update to 1.11.0
  * Fixed Bugs:
    + BeanComparator.compare(T, T) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    all cases of ReflectiveOperationException.
    + MappedMethodReference.get() now throws IllegalStateException
    instead of RuntimeException to wrap cases of
    NoSuchMethodException.
    + ResultSetIterator.get(String) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.hasNext() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.next() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.set(String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.set(String, String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
  * Changes:
    + Add org.apache.commons.beanutils
    .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.
    Fixes bsc#1243793, CVE-2025-48734
    + Bump org.apache.commons:commons-parent from 81 to 84.
    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.
- Modified patch:
  * apache-commons-beanutils-fix-build-version.patch
    + make more generic and pass the version from command-line</changelog>
</package>
<package pkgid="459a087f8fda454c07e63883f28205c3584587dc4c0bf2520203d4a844915744" name="apache-commons-beanutils-javadoc" arch="noarch">
  <version epoch="0" ver="1.11.0" rel="150200.3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537444800">- Updated to 1.9.3
  * This is a bug fix release, which also improves the tests for
    building on Java 8.
  * Note that Java 8 and later no longer support indexed bean
    properties on java.util.List, only on arrays like String[].
    (BEANUTILS-492). This affects PropertyUtils.getPropertyType()
    and PropertyUtils.getPropertyDescriptor(); their javadoc have
    therefore been updated to reflect this change in the JDK.
  * Changes in this version include:
  - Fixed Bugs:
  * BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector
  * BEANUTILS-492: Fixed exception when setting indexed properties
    on DynaBeans.
  * BEANUTILS-470: Precision lost when converting BigDecimal.
  * BEANUTILS-465: Indexed List Setters fixed.
  - Changes:
  * BEANUTILS-433: Update dependency from JUnit 3.8.1 to 4.12.
  * BEANUTILS-469: Update commons-logging from 1.1.1 to 1.2.
  * BEANUTILS-474: FluentPropertyBeanIntrospector does not use the
    same naming algorithm as DefaultBeanIntrospector.
  * BEANUTILS-490: Update Java requirement from Java 5 to 6.
  * BEANUTILS-482: Update commons-collections from 3.2.1 to 3.2.2
    (CVE-2015-4852).
  * BEANUTILS-490: Update java requirement to Java 6.
  * BEANUTILS-492: IndexedPropertyDescriptor tests now pass on Java 8.
  * BEANUTILS-495: DateConverterTestBase fails on M/d/yy in Java 9.
  * BEANUTILS-496: testGetDescriptorInvalidBoolean fails on Java 9.
  - Historical list of changes:
    http://commons.apache.org/proper/commons-beanutils/changes-report.html
- Refreshed patch jdk9.patch for this version update</changelog>
  <changelog author="tchvatal@suse.com" date="1537531200">- Fix the Source URLs to use mirrors properly</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Cleanup the maven pom files installation</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566388800">- Update to 1.9.4
  * BEANUTILS-520: BeanUtils mitigate CVE-2014-0114
- Security fix: [bsc#1146657, CVE-2019-10086]
  * PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
    level property access by default, thus protecting against CVE-2014-0114.
- Fix build version in build.xml
  * Added apache-commons-beanutils-fix-build-version.patch</changelog>
  <changelog author="fstrba@suse.com" date="1570104000">- Remove reference to parent pom, since it is not needed when not
  building with maven</changelog>
  <changelog author="fstrba@suse.com" date="1570449600">- Add aliases to account for the ephemeral commons-beanutils-core
  and commons-beanutils-bean-collections split.</changelog>
  <changelog author="fstrba@suse.com" date="1698753600">- Clean and simplify the spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1708603200">- Fix build with SLE12</changelog>
  <changelog author="gus.kenion@suse.com" date="1743163200">- Update to 1.10.1
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector concurrency
    issue (backport to 1.X) #325.
    + Javadoc is missing its Overview page.
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + Deprecate BeanUtils.BeanUtils().
    + Deprecate ConstructorUtils.ConstructorUtils().
    + Deprecate LocaleBeanUtils.LocaleBeanUtils().
    + Deprecate LocaleConvertUtils.LocaleConvertUtils().
    + Deprecate ConvertUtils.ConvertUtils().
    + Deprecate MethodUtils.MethodUtils().
    + Deprecate PropertyUtils.PropertyUtils().
  * Changes:
    + Bump org.apache.commons:commons-parent from 78 to 81.
- Includes changes from 1.10.0
  * Fixed Bugs:
    + BEANUTILS-541:  FluentPropertyBeanIntrospector caches
    corrupted writeMethod (1.x backport) #69.
    + Replace internal use of Locale.ENGLISH with Locale.ROOT.
    + Replace Maven CLIRR plugin with JApiCmp.
    + Port to Java 1.4 Throwable APIs (!).
    + Fix Javadoc generation on Java 8, 17, and 21.
    + AbstractArrayConverter.parseElements(String) now returns a
    List&lt;String&gt; instead of a raw List.
  * Changes:
    + Bump org.apache.commons:commons-parent from 47 to 78.
    + Bump Java requirement from Java 6 to 8.
    + Bump junit:junit from 4.12 to 4.13.2.
    + Bump JUnit from 4.x to 5.x "vintage".
    + Bump commons-logging:commons-logging from 1.2 to 1.3.4.
    + Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
    + Deprecate BeanUtils.initCause(Throwable, Throwable) for
    removal, use Throwable.initCause(Throwable).
- Update apache-commons-beanutils-fix-build-version.patch to
  reflect new version.</changelog>
  <changelog author="fstrba@suse.com" date="1748520000">- Update to 1.11.0
  * Fixed Bugs:
    + BeanComparator.compare(T, T) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    all cases of ReflectiveOperationException.
    + MappedMethodReference.get() now throws IllegalStateException
    instead of RuntimeException to wrap cases of
    NoSuchMethodException.
    + ResultSetIterator.get(String) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.hasNext() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.next() now throws IllegalStateException
    instead of RuntimeException to wrap cases of SQLException.
    + ResultSetIterator.set(String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
    + ResultSetIterator.set(String, String, Object) now throws
    IllegalArgumentException instead of RuntimeException to wrap
    cases of SQLException.
  * Changes:
    + Add org.apache.commons.beanutils
    .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS.
    Fixes bsc#1243793, CVE-2025-48734
    + Bump org.apache.commons:commons-parent from 81 to 84.
    + Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.
- Modified patch:
  * apache-commons-beanutils-fix-build-version.patch
    + make more generic and pass the version from command-line</changelog>
</package>
<package pkgid="65dce03d249a88eb8284ff84b40ca1da2d12ba1ad4ebdd22e09a841b553593b4" name="apache-commons-cli" arch="noarch">
  <version epoch="0" ver="1.9.0" rel="150200.3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build with new javapackages-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * commons-cli-1.2-jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1506686400">- Don't condition the maven defines on release version, but on
  _maven_repository being defined</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * commons-cli-1.2-jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on the documentation</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Upgrade to version 1.4
- Modify the build.xml.tar.bz2 to build with source/target 8 and
  adapt for the commons-cli-1.4
- Modified patch:
  * commons-cli-1.2-jdk9.patch -&gt; commons-cli-1.4-jdk9.patch
    + Rediff the remaining hunk to the changed context of pom.xml</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- Clean-up the spec file
- Removed patch:
  * commons-cli-1.4-jdk9.patch
    + not needed since we are not building with maven
- Added patch:
  * CLI-253-workaround.patch
    + [CLI-253] Prevent "Unrecognized option: --null" when handling
  long opts in PosixParser</changelog>
  <changelog author="jengelh@inai.de" date="1549368001">- Trim bias from description; update RPM groups.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613131200">- Add OSGi manifest to the build files.
- Set java source/target levels to 6</changelog>
  <changelog author="david.anes@suse.com" date="1639656000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated build XML file to new version.
- Harmonized the use of X.Y.X strings everywhere.
- Updated new source locations from Apache.
- Added 'apache-commons-cli-rpmlintrc' to silence 'package-with-huge-docs' warning (Javadoc generates many files...)
- Update to 1.5:
  * New features:
  - (CLI-217) Accommodate toggling partial matching in DefaultParser. Thanks to Rubin Simons.
  - (CLI-274) Option parser type EXISTING_FILE_VALUE not check file existing Thanks to Béla Schaum.
  - (CLI-271) CommandLine.getXXX and CommandLine.hasXXX should accept an Option as a parameter Thanks to Christoph Läubrich.
  - (CLI-276) Adjust access-modifier of checkRequiredOptions() to protected. Thanks to Jason Dillon.
  - (CLI-282) TypeHandler should throw ParseException for an unsupported class. Thanks to Alex Nordlund.
  - Added setter for Builder.option #33. Thanks to Waldemar Sojka, Gary Gregory.
  - Add Option unit tests #76. Thanks to Waldemar Sojka, Gary Gregory.
  * Fixed bugs:
  - Fix NPE in DefaultParser.isLongOption(String). Thanks to Gary Gregory.
  - (CLI-279) @param or @return lines should end with a period in CommandLine.java Thanks to Krishna Mohan Rao Kandunoori.
  - Replace deprecated FindBugs with SpotBugs. Thanks to Gary Gregory.
  - Replace CLIRR with JApiCmp. Thanks to Gary Gregory.
  - Option Javadocs grammar nits #55. Thanks to Elliotte Rusty Harold.
  - Minor Improvements #57, #61. Thanks to Arturo Bernal, Gary Gregory.
  - (CLI-254) Input "test" gets parsed as test, quotes die #58. Thanks to stoty.
  - (CLI-287) Allow whitespace-only header and footer #26. Thanks to MrQubo, Gary Gregory.
  * Updates:
  - (CLI-294) Update Java from version 5 to 7.
  - Docs: Replace OptionBuilder in usage page #30. Thanks to Mincong Huang.
  - Remove deprecated sudo setting. #36. Thanks to dengliming.
  - Bump junit:junit from 4.12 to 4.13.2, #53, #60. Thanks to Gary Gregory, Dependabot.
  - Bump commons-parent from 48 to 52. Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.12.0 to 3.15.0, #44, #54, #67. Thanks to Dependabot.
  - Bump actions/checkout from v2.3.1 to v2.3.5 #46, #72. Thanks to Dependabot.
  - Bump actions/setup-java from v1.4.2 to v2 #50. Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 1.7 to 3.0.0 #43. Thanks to Dependabot.
  - Bump maven-checkstyle-plugin from 2.15 to 3.1.2 #41. Thanks to Gary Gregory.
  - Bump checkstyle to 9.0.1 #68. Thanks to Gary Gregory.
  - Bump actions/cache from 2 to 2.1.6 #64, #65. Thanks to Dependabot.
  - Bump commons.animal-sniffer.version 1.19 -&gt; 1.20. Thanks to Gary Gregory.
  - Bump maven-bundle-plugin 5.1.1 -&gt; 5.1.2. Thanks to Gary Gregory.
  - Bump biz.aQute.bndlib.version 5.1.2 -&gt; 6.0.0. Thanks to Gary Gregory.
  - Bump spotbugs from 4.4.1 to 4.4.2 #70. Thanks to Dependabot.
  - Bump spotbugs-maven-plugin from 4.4.1 to 4.4.2.2 #71. Thanks to Dependabot.-</changelog>
  <changelog author="fstrba@suse.com" date="1695297600">- Build with java source/target levels 8</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated apache-commons-cli-build.xml to new version.
- Update to 1.7:
  * New features:
  - Add and use a Converter interface and implementations without
    using BeanUtils #216. Fixes CLI-321. Thanks to Claude Warren,
    Gary Gregory.
  - Add Maven property project.build.outputTimestamp for build
    reproducibility. Thanks to Gary Gregory.
  - Add '-' as an option char and implemented extensive tests
    [#217]. Fixes CLI-322. Thanks to Claude Warren, Gary Gregory.
  - Make adding OptionGroups and Options to existing Options
    easier #230. Fixes CLI-324. Thanks to Claude Warren, Gary
    Gregory.
  - Added Supplier&lt;T&gt; defaults for getParsedOptionValue #229.
    Fixes CLI-323. Thanks to Claude Warren, Gary Gregory.
  - Make Option.getKey() public #239. Fixes CLI-326. Thanks to
    Claude Warren, Gary Gregory.
  - Add builder factory CommandLine#builder(). Thanks to Claude
    Warren, Gary Gregory.
  * Fixes:
  - Inconsistent behavior in key/value pairs (Java property
    style). Fixes CLI-312. Thanks to Claude Warren, Gary Gregory.
  - Avoid NullPointerException in
    Util.stripLeadingAndTrailingQuotes(String). Thanks to Gary
    Gregory.
  - Awkward behavior of Option.builder() for multiple optional
    args. Fixes CLI-320. Thanks to Paul King, Claude Warren.
  - Properties from multiple arguments with value separator.
    [#237]. Fixes CLI-325. Thanks to Claude Warren.
  - Fix for expected textual date values. #244. Fixes CLI-327.
    Thanks to Claude Warren, Gary Gregory.
  - Option.Builder.option("") should throw
    IllegalArgumentException instead of
    ArrayIndexOutOfBoundsException. Thanks to Gary Gregory.
  - Avoid NullPointerException in
    CommandLine.getOptionValues(Option|String). Thanks to Gary
    Gregory.
  * Updates:
  - Bump commons-parent from 64 to 69 #256. Thanks to Gary
    Gregory.
  - Update the tests to JUnit 5 #238. Thanks to Elric, Gary
    Gregory.
  - Bump tests commons-io:commons-io from 2.16.0 to 2.16.1 #258.
    Thanks to Dependabot, Gary Gregory.
- Includes changes from version 1.6:
  * Fixes:
  - [StepSecurity] ci: Harden GitHub Actions #176. Thanks to
    step-security-bot, Gary Gregory.
  - Inconsistent date format in changes report. Fixes CLI-318.
    Thanks to Alexander Veit, Gary Gregory.
  - Fix NPE in CommandLine.resolveOption(String). Fixes CLI-283.
    Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addOption(Option) should not allow a null Option.
    Fixes CLI-283. Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addArgs(String) should not allow a null String.
    Fixes CLI-283. Thanks to Gary Gregory.
  - Site docs: "Usage Scenarios" refers to deprecated methods.
    Fixes CLI-303. Thanks to Julian Schilling, Gary Gregory.
  - NullPointerException thrown by CommandLineParser.parse().
    Fixes CLI-317. Thanks to Philippe Bastiani, Sruteesh Kumar
    Paramata, Gary Gregory.
  - StringIndexOutOfBoundsException thrown by
    CommandLineParser.parse(). Fixes CLI-313. Thanks to Dominik
    Stadler, HUNG LU, Sruteesh Kumar Paramata.
  * Updates:
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 417-423]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 446-450]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 474-478]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Use EMPTY_STRING_ARRAY constant. #102. Thanks to Ken Dombeck.
  - Fix site links that are broken #155. Thanks to Arturo Bernal.
  - Use Math.max() #111. Delete unused assignment #112. Thanks to
    Arturo Bernal.
  - Add github/codeql-action. Thanks to Dependabot, Gary Gregory.
  - Bump Java from 7 to 8. Thanks to Gary Gregory.
  - Bump actions/cache from 2.1.7 to 3.0.10 #97, #130, #132.
    Thanks to Dependabot, Gary Gregory.
  - Bump actions/checkout from 3 to 3.1.0 #133. Thanks to Gary
    Gregory, Dependabot.
  - Bump actions/setup-java from 2 to 3.6.0 #136. Thanks to Gary
    Gregory.
  - Bump spotbugs from 4.5.3 to 4.7.3 #96, #107, #113, #125,
    [#138]. Thanks to Gary Gregory, Dependabot.
  - Bump spotbugs-maven-plugin from 4.5.3.0 to 4.7.3.0 #98, #108,
    [#115], #117, #126, #145. Thanks to Dependabot.
  - Bump commons-parent from 52 to 64 #100, #128, #151, #158.
    Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 3.0.0 to 3.1.0 #103. Thanks to
    Dependabot.
  - Bump maven-javadoc-plugin from 3.3.2 to 3.4.1 #105, #120.
    Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.16.0 to 3.19.0 #110, #124.
    Thanks to Dependabot.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. Thanks to Gary
    Gregory.
  - Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #121. Thanks
    to Gary Gregory.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0. Thanks to
    Gary Gregory.
  - Update JUnit 4 to 5 vintage. Thanks to Gary Gregory.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Update to 1.8.0
  * Fix Javadoc pathing #280. Fixes CLI-334.
- Revised CLI-253-workaround.patch for compatibility with 1.8.0</changelog>
  <changelog author="gus.kenion@suse.com" date="1730980800">- Update to 1.9.0
  * New features
    + Add OptionGroup.isSelected().
    + You can now extend HelpFormatter.Builder.
    + Add 'since' attribute to Option to track when an Option was
    introduced #292
  * Fixed bugs
    + CLI-334:  Fix Javadoc pathing #280.
    + CLI-335:  Updated properties documentation #285.
    + CLI-336:  Deprecation not always reported #284.
    + Replace internal StringBuffer with StringBuilder.
  * Updates
    + Bump org.apache.commons:commons-parent from 70 to 72 #283.</changelog>
</package>
<package pkgid="a10010160a55d68a8f79c8da0fbef4f1b59dcd30ea74ddec9ad11fcafedd698b" name="apache-commons-cli" arch="src">
  <version epoch="0" ver="1.9.0" rel="150200.3.9.1"/>
  <changelog author="dmacvicar@suse.de" date="1323691200">- rename apache-cli to apache-commons-cli
- add java() provides</changelog>
  <changelog author="badshah400@gmail.com" date="1394280000">- For openSUSE &gt;= 13.1 remove all references to maven scripts as
  these do not work; fixes building for openSUSE &gt;= 13.1
- Lots of specfile formatting cleanups
- Move old %changelog section entries to .changes with proper
  formatting
- Add copyright info to spec file.</changelog>
  <changelog author="tchvatal@suse.com" date="1403870400">- Fix the pom providing on 13.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build with new javapackages-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * commons-cli-1.2-jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1506686400">- Don't condition the maven defines on release version, but on
  _maven_repository being defined</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * commons-cli-1.2-jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on the documentation</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Upgrade to version 1.4
- Modify the build.xml.tar.bz2 to build with source/target 8 and
  adapt for the commons-cli-1.4
- Modified patch:
  * commons-cli-1.2-jdk9.patch -&gt; commons-cli-1.4-jdk9.patch
    + Rediff the remaining hunk to the changed context of pom.xml</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- Clean-up the spec file
- Removed patch:
  * commons-cli-1.4-jdk9.patch
    + not needed since we are not building with maven
- Added patch:
  * CLI-253-workaround.patch
    + [CLI-253] Prevent "Unrecognized option: --null" when handling
  long opts in PosixParser</changelog>
  <changelog author="jengelh@inai.de" date="1549368001">- Trim bias from description; update RPM groups.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613131200">- Add OSGi manifest to the build files.
- Set java source/target levels to 6</changelog>
  <changelog author="david.anes@suse.com" date="1639656000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated build XML file to new version.
- Harmonized the use of X.Y.X strings everywhere.
- Updated new source locations from Apache.
- Added 'apache-commons-cli-rpmlintrc' to silence 'package-with-huge-docs' warning (Javadoc generates many files...)
- Update to 1.5:
  * New features:
  - (CLI-217) Accommodate toggling partial matching in DefaultParser. Thanks to Rubin Simons.
  - (CLI-274) Option parser type EXISTING_FILE_VALUE not check file existing Thanks to Béla Schaum.
  - (CLI-271) CommandLine.getXXX and CommandLine.hasXXX should accept an Option as a parameter Thanks to Christoph Läubrich.
  - (CLI-276) Adjust access-modifier of checkRequiredOptions() to protected. Thanks to Jason Dillon.
  - (CLI-282) TypeHandler should throw ParseException for an unsupported class. Thanks to Alex Nordlund.
  - Added setter for Builder.option #33. Thanks to Waldemar Sojka, Gary Gregory.
  - Add Option unit tests #76. Thanks to Waldemar Sojka, Gary Gregory.
  * Fixed bugs:
  - Fix NPE in DefaultParser.isLongOption(String). Thanks to Gary Gregory.
  - (CLI-279) @param or @return lines should end with a period in CommandLine.java Thanks to Krishna Mohan Rao Kandunoori.
  - Replace deprecated FindBugs with SpotBugs. Thanks to Gary Gregory.
  - Replace CLIRR with JApiCmp. Thanks to Gary Gregory.
  - Option Javadocs grammar nits #55. Thanks to Elliotte Rusty Harold.
  - Minor Improvements #57, #61. Thanks to Arturo Bernal, Gary Gregory.
  - (CLI-254) Input "test" gets parsed as test, quotes die #58. Thanks to stoty.
  - (CLI-287) Allow whitespace-only header and footer #26. Thanks to MrQubo, Gary Gregory.
  * Updates:
  - (CLI-294) Update Java from version 5 to 7.
  - Docs: Replace OptionBuilder in usage page #30. Thanks to Mincong Huang.
  - Remove deprecated sudo setting. #36. Thanks to dengliming.
  - Bump junit:junit from 4.12 to 4.13.2, #53, #60. Thanks to Gary Gregory, Dependabot.
  - Bump commons-parent from 48 to 52. Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.12.0 to 3.15.0, #44, #54, #67. Thanks to Dependabot.
  - Bump actions/checkout from v2.3.1 to v2.3.5 #46, #72. Thanks to Dependabot.
  - Bump actions/setup-java from v1.4.2 to v2 #50. Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 1.7 to 3.0.0 #43. Thanks to Dependabot.
  - Bump maven-checkstyle-plugin from 2.15 to 3.1.2 #41. Thanks to Gary Gregory.
  - Bump checkstyle to 9.0.1 #68. Thanks to Gary Gregory.
  - Bump actions/cache from 2 to 2.1.6 #64, #65. Thanks to Dependabot.
  - Bump commons.animal-sniffer.version 1.19 -&gt; 1.20. Thanks to Gary Gregory.
  - Bump maven-bundle-plugin 5.1.1 -&gt; 5.1.2. Thanks to Gary Gregory.
  - Bump biz.aQute.bndlib.version 5.1.2 -&gt; 6.0.0. Thanks to Gary Gregory.
  - Bump spotbugs from 4.4.1 to 4.4.2 #70. Thanks to Dependabot.
  - Bump spotbugs-maven-plugin from 4.4.1 to 4.4.2.2 #71. Thanks to Dependabot.-</changelog>
  <changelog author="fstrba@suse.com" date="1695297600">- Build with java source/target levels 8</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated apache-commons-cli-build.xml to new version.
- Update to 1.7:
  * New features:
  - Add and use a Converter interface and implementations without
    using BeanUtils #216. Fixes CLI-321. Thanks to Claude Warren,
    Gary Gregory.
  - Add Maven property project.build.outputTimestamp for build
    reproducibility. Thanks to Gary Gregory.
  - Add '-' as an option char and implemented extensive tests
    [#217]. Fixes CLI-322. Thanks to Claude Warren, Gary Gregory.
  - Make adding OptionGroups and Options to existing Options
    easier #230. Fixes CLI-324. Thanks to Claude Warren, Gary
    Gregory.
  - Added Supplier&lt;T&gt; defaults for getParsedOptionValue #229.
    Fixes CLI-323. Thanks to Claude Warren, Gary Gregory.
  - Make Option.getKey() public #239. Fixes CLI-326. Thanks to
    Claude Warren, Gary Gregory.
  - Add builder factory CommandLine#builder(). Thanks to Claude
    Warren, Gary Gregory.
  * Fixes:
  - Inconsistent behavior in key/value pairs (Java property
    style). Fixes CLI-312. Thanks to Claude Warren, Gary Gregory.
  - Avoid NullPointerException in
    Util.stripLeadingAndTrailingQuotes(String). Thanks to Gary
    Gregory.
  - Awkward behavior of Option.builder() for multiple optional
    args. Fixes CLI-320. Thanks to Paul King, Claude Warren.
  - Properties from multiple arguments with value separator.
    [#237]. Fixes CLI-325. Thanks to Claude Warren.
  - Fix for expected textual date values. #244. Fixes CLI-327.
    Thanks to Claude Warren, Gary Gregory.
  - Option.Builder.option("") should throw
    IllegalArgumentException instead of
    ArrayIndexOutOfBoundsException. Thanks to Gary Gregory.
  - Avoid NullPointerException in
    CommandLine.getOptionValues(Option|String). Thanks to Gary
    Gregory.
  * Updates:
  - Bump commons-parent from 64 to 69 #256. Thanks to Gary
    Gregory.
  - Update the tests to JUnit 5 #238. Thanks to Elric, Gary
    Gregory.
  - Bump tests commons-io:commons-io from 2.16.0 to 2.16.1 #258.
    Thanks to Dependabot, Gary Gregory.
- Includes changes from version 1.6:
  * Fixes:
  - [StepSecurity] ci: Harden GitHub Actions #176. Thanks to
    step-security-bot, Gary Gregory.
  - Inconsistent date format in changes report. Fixes CLI-318.
    Thanks to Alexander Veit, Gary Gregory.
  - Fix NPE in CommandLine.resolveOption(String). Fixes CLI-283.
    Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addOption(Option) should not allow a null Option.
    Fixes CLI-283. Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addArgs(String) should not allow a null String.
    Fixes CLI-283. Thanks to Gary Gregory.
  - Site docs: "Usage Scenarios" refers to deprecated methods.
    Fixes CLI-303. Thanks to Julian Schilling, Gary Gregory.
  - NullPointerException thrown by CommandLineParser.parse().
    Fixes CLI-317. Thanks to Philippe Bastiani, Sruteesh Kumar
    Paramata, Gary Gregory.
  - StringIndexOutOfBoundsException thrown by
    CommandLineParser.parse(). Fixes CLI-313. Thanks to Dominik
    Stadler, HUNG LU, Sruteesh Kumar Paramata.
  * Updates:
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 417-423]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 446-450]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 474-478]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Use EMPTY_STRING_ARRAY constant. #102. Thanks to Ken Dombeck.
  - Fix site links that are broken #155. Thanks to Arturo Bernal.
  - Use Math.max() #111. Delete unused assignment #112. Thanks to
    Arturo Bernal.
  - Add github/codeql-action. Thanks to Dependabot, Gary Gregory.
  - Bump Java from 7 to 8. Thanks to Gary Gregory.
  - Bump actions/cache from 2.1.7 to 3.0.10 #97, #130, #132.
    Thanks to Dependabot, Gary Gregory.
  - Bump actions/checkout from 3 to 3.1.0 #133. Thanks to Gary
    Gregory, Dependabot.
  - Bump actions/setup-java from 2 to 3.6.0 #136. Thanks to Gary
    Gregory.
  - Bump spotbugs from 4.5.3 to 4.7.3 #96, #107, #113, #125,
    [#138]. Thanks to Gary Gregory, Dependabot.
  - Bump spotbugs-maven-plugin from 4.5.3.0 to 4.7.3.0 #98, #108,
    [#115], #117, #126, #145. Thanks to Dependabot.
  - Bump commons-parent from 52 to 64 #100, #128, #151, #158.
    Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 3.0.0 to 3.1.0 #103. Thanks to
    Dependabot.
  - Bump maven-javadoc-plugin from 3.3.2 to 3.4.1 #105, #120.
    Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.16.0 to 3.19.0 #110, #124.
    Thanks to Dependabot.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. Thanks to Gary
    Gregory.
  - Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #121. Thanks
    to Gary Gregory.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0. Thanks to
    Gary Gregory.
  - Update JUnit 4 to 5 vintage. Thanks to Gary Gregory.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Update to 1.8.0
  * Fix Javadoc pathing #280. Fixes CLI-334.
- Revised CLI-253-workaround.patch for compatibility with 1.8.0</changelog>
  <changelog author="gus.kenion@suse.com" date="1730980800">- Update to 1.9.0
  * New features
    + Add OptionGroup.isSelected().
    + You can now extend HelpFormatter.Builder.
    + Add 'since' attribute to Option to track when an Option was
    introduced #292
  * Fixed bugs
    + CLI-334:  Fix Javadoc pathing #280.
    + CLI-335:  Updated properties documentation #285.
    + CLI-336:  Deprecation not always reported #284.
    + Replace internal StringBuffer with StringBuilder.
  * Updates
    + Bump org.apache.commons:commons-parent from 70 to 72 #283.</changelog>
</package>
<package pkgid="7721a4c3edb069bb1ada129ed460fa14f111c0d63abc193fbf207c34583080a2" name="apache-commons-cli-javadoc" arch="noarch">
  <version epoch="0" ver="1.9.0" rel="150200.3.9.1"/>
  <changelog author="p.drouand@gmail.com" date="1417694400">- Remove java-devel dependency; not needed anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build with new javapackages-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Added patch:
  * commons-cli-1.2-jdk9.patch
  - Specify java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1506686400">- Don't condition the maven defines on release version, but on
  _maven_repository being defined</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * commons-cli-1.2-jdk9.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility
- Run fdupes on the documentation</changelog>
  <changelog author="fstrba@suse.com" date="1540296000">- Upgrade to version 1.4
- Modify the build.xml.tar.bz2 to build with source/target 8 and
  adapt for the commons-cli-1.4
- Modified patch:
  * commons-cli-1.2-jdk9.patch -&gt; commons-cli-1.4-jdk9.patch
    + Rediff the remaining hunk to the changed context of pom.xml</changelog>
  <changelog author="fstrba@suse.com" date="1549368000">- Clean-up the spec file
- Removed patch:
  * commons-cli-1.4-jdk9.patch
    + not needed since we are not building with maven
- Added patch:
  * CLI-253-workaround.patch
    + [CLI-253] Prevent "Unrecognized option: --null" when handling
  long opts in PosixParser</changelog>
  <changelog author="jengelh@inai.de" date="1549368001">- Trim bias from description; update RPM groups.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613131200">- Add OSGi manifest to the build files.
- Set java source/target levels to 6</changelog>
  <changelog author="david.anes@suse.com" date="1639656000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated build XML file to new version.
- Harmonized the use of X.Y.X strings everywhere.
- Updated new source locations from Apache.
- Added 'apache-commons-cli-rpmlintrc' to silence 'package-with-huge-docs' warning (Javadoc generates many files...)
- Update to 1.5:
  * New features:
  - (CLI-217) Accommodate toggling partial matching in DefaultParser. Thanks to Rubin Simons.
  - (CLI-274) Option parser type EXISTING_FILE_VALUE not check file existing Thanks to Béla Schaum.
  - (CLI-271) CommandLine.getXXX and CommandLine.hasXXX should accept an Option as a parameter Thanks to Christoph Läubrich.
  - (CLI-276) Adjust access-modifier of checkRequiredOptions() to protected. Thanks to Jason Dillon.
  - (CLI-282) TypeHandler should throw ParseException for an unsupported class. Thanks to Alex Nordlund.
  - Added setter for Builder.option #33. Thanks to Waldemar Sojka, Gary Gregory.
  - Add Option unit tests #76. Thanks to Waldemar Sojka, Gary Gregory.
  * Fixed bugs:
  - Fix NPE in DefaultParser.isLongOption(String). Thanks to Gary Gregory.
  - (CLI-279) @param or @return lines should end with a period in CommandLine.java Thanks to Krishna Mohan Rao Kandunoori.
  - Replace deprecated FindBugs with SpotBugs. Thanks to Gary Gregory.
  - Replace CLIRR with JApiCmp. Thanks to Gary Gregory.
  - Option Javadocs grammar nits #55. Thanks to Elliotte Rusty Harold.
  - Minor Improvements #57, #61. Thanks to Arturo Bernal, Gary Gregory.
  - (CLI-254) Input "test" gets parsed as test, quotes die #58. Thanks to stoty.
  - (CLI-287) Allow whitespace-only header and footer #26. Thanks to MrQubo, Gary Gregory.
  * Updates:
  - (CLI-294) Update Java from version 5 to 7.
  - Docs: Replace OptionBuilder in usage page #30. Thanks to Mincong Huang.
  - Remove deprecated sudo setting. #36. Thanks to dengliming.
  - Bump junit:junit from 4.12 to 4.13.2, #53, #60. Thanks to Gary Gregory, Dependabot.
  - Bump commons-parent from 48 to 52. Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.12.0 to 3.15.0, #44, #54, #67. Thanks to Dependabot.
  - Bump actions/checkout from v2.3.1 to v2.3.5 #46, #72. Thanks to Dependabot.
  - Bump actions/setup-java from v1.4.2 to v2 #50. Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 1.7 to 3.0.0 #43. Thanks to Dependabot.
  - Bump maven-checkstyle-plugin from 2.15 to 3.1.2 #41. Thanks to Gary Gregory.
  - Bump checkstyle to 9.0.1 #68. Thanks to Gary Gregory.
  - Bump actions/cache from 2 to 2.1.6 #64, #65. Thanks to Dependabot.
  - Bump commons.animal-sniffer.version 1.19 -&gt; 1.20. Thanks to Gary Gregory.
  - Bump maven-bundle-plugin 5.1.1 -&gt; 5.1.2. Thanks to Gary Gregory.
  - Bump biz.aQute.bndlib.version 5.1.2 -&gt; 6.0.0. Thanks to Gary Gregory.
  - Bump spotbugs from 4.4.1 to 4.4.2 #70. Thanks to Dependabot.
  - Bump spotbugs-maven-plugin from 4.4.1 to 4.4.2.2 #71. Thanks to Dependabot.-</changelog>
  <changelog author="fstrba@suse.com" date="1695297600">- Build with java source/target levels 8</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Rebased patch CLI-253-workaround.patch to new version.
- Updated apache-commons-cli-build.xml to new version.
- Update to 1.7:
  * New features:
  - Add and use a Converter interface and implementations without
    using BeanUtils #216. Fixes CLI-321. Thanks to Claude Warren,
    Gary Gregory.
  - Add Maven property project.build.outputTimestamp for build
    reproducibility. Thanks to Gary Gregory.
  - Add '-' as an option char and implemented extensive tests
    [#217]. Fixes CLI-322. Thanks to Claude Warren, Gary Gregory.
  - Make adding OptionGroups and Options to existing Options
    easier #230. Fixes CLI-324. Thanks to Claude Warren, Gary
    Gregory.
  - Added Supplier&lt;T&gt; defaults for getParsedOptionValue #229.
    Fixes CLI-323. Thanks to Claude Warren, Gary Gregory.
  - Make Option.getKey() public #239. Fixes CLI-326. Thanks to
    Claude Warren, Gary Gregory.
  - Add builder factory CommandLine#builder(). Thanks to Claude
    Warren, Gary Gregory.
  * Fixes:
  - Inconsistent behavior in key/value pairs (Java property
    style). Fixes CLI-312. Thanks to Claude Warren, Gary Gregory.
  - Avoid NullPointerException in
    Util.stripLeadingAndTrailingQuotes(String). Thanks to Gary
    Gregory.
  - Awkward behavior of Option.builder() for multiple optional
    args. Fixes CLI-320. Thanks to Paul King, Claude Warren.
  - Properties from multiple arguments with value separator.
    [#237]. Fixes CLI-325. Thanks to Claude Warren.
  - Fix for expected textual date values. #244. Fixes CLI-327.
    Thanks to Claude Warren, Gary Gregory.
  - Option.Builder.option("") should throw
    IllegalArgumentException instead of
    ArrayIndexOutOfBoundsException. Thanks to Gary Gregory.
  - Avoid NullPointerException in
    CommandLine.getOptionValues(Option|String). Thanks to Gary
    Gregory.
  * Updates:
  - Bump commons-parent from 64 to 69 #256. Thanks to Gary
    Gregory.
  - Update the tests to JUnit 5 #238. Thanks to Elric, Gary
    Gregory.
  - Bump tests commons-io:commons-io from 2.16.0 to 2.16.1 #258.
    Thanks to Dependabot, Gary Gregory.
- Includes changes from version 1.6:
  * Fixes:
  - [StepSecurity] ci: Harden GitHub Actions #176. Thanks to
    step-security-bot, Gary Gregory.
  - Inconsistent date format in changes report. Fixes CLI-318.
    Thanks to Alexander Veit, Gary Gregory.
  - Fix NPE in CommandLine.resolveOption(String). Fixes CLI-283.
    Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addOption(Option) should not allow a null Option.
    Fixes CLI-283. Thanks to Dilraj Singh, Gary Gregory.
  - CommandLine.addArgs(String) should not allow a null String.
    Fixes CLI-283. Thanks to Gary Gregory.
  - Site docs: "Usage Scenarios" refers to deprecated methods.
    Fixes CLI-303. Thanks to Julian Schilling, Gary Gregory.
  - NullPointerException thrown by CommandLineParser.parse().
    Fixes CLI-317. Thanks to Philippe Bastiani, Sruteesh Kumar
    Paramata, Gary Gregory.
  - StringIndexOutOfBoundsException thrown by
    CommandLineParser.parse(). Fixes CLI-313. Thanks to Dominik
    Stadler, HUNG LU, Sruteesh Kumar Paramata.
  * Updates:
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 417-423]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 446-450]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Fix SpotBugs Error: Medium: Method intentionally throws
    RuntimeException. [org.apache.commons.cli.Option] At
    Option.java:[lines 474-478]
    THROWS_METHOD_THROWS_RUNTIMEEXCEPTION Thanks to Gary Gregory.
  - Use EMPTY_STRING_ARRAY constant. #102. Thanks to Ken Dombeck.
  - Fix site links that are broken #155. Thanks to Arturo Bernal.
  - Use Math.max() #111. Delete unused assignment #112. Thanks to
    Arturo Bernal.
  - Add github/codeql-action. Thanks to Dependabot, Gary Gregory.
  - Bump Java from 7 to 8. Thanks to Gary Gregory.
  - Bump actions/cache from 2.1.7 to 3.0.10 #97, #130, #132.
    Thanks to Dependabot, Gary Gregory.
  - Bump actions/checkout from 3 to 3.1.0 #133. Thanks to Gary
    Gregory, Dependabot.
  - Bump actions/setup-java from 2 to 3.6.0 #136. Thanks to Gary
    Gregory.
  - Bump spotbugs from 4.5.3 to 4.7.3 #96, #107, #113, #125,
    [#138]. Thanks to Gary Gregory, Dependabot.
  - Bump spotbugs-maven-plugin from 4.5.3.0 to 4.7.3.0 #98, #108,
    [#115], #117, #126, #145. Thanks to Dependabot.
  - Bump commons-parent from 52 to 64 #100, #128, #151, #158.
    Thanks to Dependabot, Gary Gregory.
  - Bump maven-antrun-plugin from 3.0.0 to 3.1.0 #103. Thanks to
    Dependabot.
  - Bump maven-javadoc-plugin from 3.3.2 to 3.4.1 #105, #120.
    Thanks to Dependabot.
  - Bump maven-pmd-plugin from 3.16.0 to 3.19.0 #110, #124.
    Thanks to Dependabot.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. Thanks to Gary
    Gregory.
  - Bump maven-checkstyle-plugin from 3.1.2 to 3.2.0 #121. Thanks
    to Gary Gregory.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0. Thanks to
    Gary Gregory.
  - Update JUnit 4 to 5 vintage. Thanks to Gary Gregory.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Update to 1.8.0
  * Fix Javadoc pathing #280. Fixes CLI-334.
- Revised CLI-253-workaround.patch for compatibility with 1.8.0</changelog>
  <changelog author="gus.kenion@suse.com" date="1730980800">- Update to 1.9.0
  * New features
    + Add OptionGroup.isSelected().
    + You can now extend HelpFormatter.Builder.
    + Add 'since' attribute to Option to track when an Option was
    introduced #292
  * Fixed bugs
    + CLI-334:  Fix Javadoc pathing #280.
    + CLI-335:  Updated properties documentation #285.
    + CLI-336:  Deprecation not always reported #284.
    + Replace internal StringBuffer with StringBuilder.
  * Updates
    + Bump org.apache.commons:commons-parent from 70 to 72 #283.</changelog>
</package>
<package pkgid="ac7fff32960102cf47cbe3aec0ff70b8e7729de19917a22a98ded6530a87acfe" name="apache-commons-daemon" arch="aarch64">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="39f636ef31ee182b8aa4afcd49c8e6b4aef9e91c908f3de47eb8aba2a1844ead" name="apache-commons-daemon" arch="ppc64le">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="fcb4d77ef5d9796d25e78bae8dd73265b233ad8a9a741f2f060e6a4a79737096" name="apache-commons-daemon" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="eced96cdc64b9d3e48c29e706c0cbdaa596bc7ce76459c9eb8f7b34c9849def2" name="apache-commons-daemon" arch="src">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="66117025d03efd9487fdc795b35c9a46b6c48fea438b2540f284a03f37a63cdf" name="apache-commons-daemon" arch="x86_64">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="66588d9032ae056712fc0d5b8f2bc39bbf6f3c920937f7dfa0a20d4ff7582998" name="apache-commons-daemon-javadoc" arch="noarch">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="7a52c53f30d1326b8e42c8e502164db23a8db0820c719f4f035249f194038fb6" name="apache-commons-daemon-jsvc" arch="aarch64">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="b925e1f0a60adc609e4536dc66df8397ffa93f1a05740315034b483b1e2f07b0" name="apache-commons-daemon-jsvc" arch="ppc64le">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="2e292a99849b0bb46e6a75dc815786a132434a76c967f72e36995835786465d5" name="apache-commons-daemon-jsvc" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="ceef41adc8394a5912c6764a0ca2e333f4067b8799f892243673d02f36aab8e6" name="apache-commons-daemon-jsvc" arch="x86_64">
  <version epoch="0" ver="1.4.0" rel="150200.11.17.1"/>
  <changelog author="tchvatal@suse.com" date="1427198400">- Drop unused patches:
  * 0001-execve-path-warning.patch
  * config-guess-sub-update.patch
  * jsvc-libcap-relative.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg verification. We can stick to what osc services do for us</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix jdk9 build by specifying java source and target 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="schwab@suse.de" date="1531396800">- apache-commons-daemon-riscv64.patch: add riscv64 to the list of
  supported cpus
- Use %license for LICENSE.txt</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591358400">- Update to 1.2.2
  * Release 1.2.2 - 2019-10-04
  - Fix: Procrun. Correct a regression in the fix for DAEMON-401
    that prevented the service from starting unless support for the
    universal C runtime had been installed.
  - Update: Update Commons-Parent to version 49.
  * Release 1.2.1 - 2019-09-09
  - Fix: jsvc. Correct debug log message that reports change in umask.
  - Fix: Procrun. Correct a regression in the previous fix for this
    issue that caused 32-bit services to crash on start-up. Fixes DAEMON-401.
  - Fix: Procrun. Correct a regression in the fix for DAEMON-391
    that caused the GUI to mix-up the WARN and INFO logging levels.
  * Release 1.2.0 - 2019-07-02
  - Fix: Procrun. Only set the global shutdown event if the event is created.
  - Fix: Unable to build with Java 9 using ant; dropped Ant build files.
  - Fix: Procrun. prunsrv stopping with error due to hard-coded timeout.
  - Fix: Update config.guess and config.sub.
  - Fix: Jsvc. Set the sun.java.command system property when starting via jsvc
    so that tools like jconsole show something meaningful for the process name.
  - Fix: Procrun. Correct the level name used in the GUI for WARN so that
    changes made via the GUI are recognised. Order the log levels in the
    drop-down from ERROR to DEBUG.
  - Fix: Procrun. Correct reversed code comments for JRE and JDK locations
    in the registry.
  - Fix: Procrun. Fix a bug that meant a value provided for LibraryPath
    replaced the value of the PATH environment variable rather than prepended to it.
  - Fix: Procrun. Ensure that the java.library.path environment variable is
    correctly configured when running on a JRE that depends on the Universal CRT.
  - Add: Procrun. Log the error code returned if JVM creation fails to aid debugging.
  - Fix: Procrun. Ensure that environment variables set via prunsrv are visible
    to native libraries that depend on the Universal CRT.
  - Fix: Procrun. Remove the code that removed quotes from configured Java and
    Java 9 Options.
  - Add: Procrun. Add an option to configure the service to use the 'Automatic
    (Delayed Start)' startup mode.
  - Add: Procrun. When running in jre mode, if the standard Java registry
    entries for JavaHome and RuntimeLib are not present, attempt to use the
    Procrun JavaHome key to find the runtime library.
  - Add: jsvc. Include the full path to the jsvc executable in the debug log.
  * Release 1.1.0 - 2017-11-15
  - Update: Update the minimum Java requirement from version 5 to 6.
  - Update: Add AArch64 support to src/native/unix/support/apsupport.m4.
  - Fix: Remove calls to explicit garbage collection during daemon start and stop.
  - Fix: Update config.guess and config.sub to add support, amongst others,
    for the 64-bit PowerPC Little-Endian architecture.
  - Update: Update Commons-Parent to version 41.
  - Fix: Update apsupport.m4 add support for 64-bit PowerPC architectures.
  - Fix: Suppress spurious "The data area passed to a system call is too small"
    error message in the log when Procrun fails to stop the service.
  - Fix: Enable jsvc to start when running on Java 9.
  - Fix: Fix a resource leak opening the JVM configuration file.
    _ Fix: Improve the jsvc code that restarts the process if the JVM crashes so
    that if the JVM crashes after a signal has been received to shut down jsvc
    does not attempt to restart the JVM.
  - Fix: Ensure that the child process is started with the correct umask.
  - Fix: Correct conflicting information for the behaviour of Procrun when
    using jvm mode.
  - Fix: Ensure that, when using Procrun in java or exe mode, the service
    process waits for the stop process to complete before starting clean-up
    to avoid a crash in the stop process.
  - Fix: Enable jsvc to find the jvm when running on AIX.
  - Fix: Ensure that Procrun treats JVM crashes as service failures so the
    recovery options will apply.
  - Fix: Ensure that the //MQ command closes the prunmgr process even if
    the configuration dialog is open when the //MQ command is used.
  - Fix: Add support for Java 9 command line arguments to jsvc.
  - Add: Add a restarts options to jsvc to control the number of permitted
    restarts after a system crash.
  - Remove: Remove support for building Procrun for the Itanium platform.
  - Fix: Fix race conditions in PID file handling in jsvc.
- Remove patches:
  * apache-commons-daemon-ppc64.patch
  * apache-commons-daemon-aarch64.patch
- Refresh patches:
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-JAVA_OS.patch
- Update project keyring.</changelog>
  <changelog author="fstrba@suse.com" date="1591704000">- Generate ant build file and customize it in order to be able to
  build this ring package without cycles. Ring packages cannot be
  built using maven.
- Modified patches:
  * apache-commons-daemon-JAVA_OS.patch
  * apache-commons-daemon-riscv64.patch
  * apache-commons-daemon-s390x.patch
    + Do not patch configure file itself, since we generate it
    during the build</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 1.2.3
  * Fix: Procrun. Correct multiple issues related to enabling a
    service to interact with the desktop. Provide a better error
    message if this option is used with an invalid user, install
    the service with the option enabled if requested and correctly
    save the setting if it is enabled in the GUI.
  * Fix: jsvc. Update the list of paths searched for libjvm.so to
    include the path used by OpenJDK 11.
  * Add: Procrun. Add additional debug logging for Java start mode.
  * Fix: jsvc. Remove incorrect definition 'supported_os' which
    defined in psupport.m4 file to fix jsvc build error on s390,
    arm, aarch64, mipsel and mips.
  * Add: More debug logging in prunsrv.c and javajni.c.
  * Add: Update arguments.c to support Java 11 --enable-preview.
  * Add: jsvc and Procrun. Add support for Java native memory tracking.
  * Add: Procrun. Add a new command, print, that outputs the command to
    (re-)configure the service with the current settings. This is
    intended to be used to save settings such as before an upgrade.
- Rebase apache-commons-daemon-riscv64.patch
- Remove apache-commons-daemon-s390x.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1612353600">- Update to 1.2.4
  * Procrun. Ensure that log messages written to stdout and stderr
    are not lost during start-up.
  * Procrun. Correct a regression introduced in 1.2.3. Enable the
    service to start if the Options value is not present in the
    registry.
  * jsvc. Don't fail if the CAP_DAC_READ_SEARCH capability is not
    available. Fall back to using argv[0] rather than
    /proc/self/exe to determine the path for the current binary.
  * Improved JRE/JDK detection to support increased range of both
    JVM versions and vendors</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Define %%make_build for systems where it is not defined in
  rpm macros</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8</changelog>
  <changelog author="pmonreal@suse.com" date="1666353600">- Update to 1.3.2:
  * Fixes:
  - Procrun. Remove noisy INFO log message that triggered logging
    once per minute while the service was running.
  - Fix typos in Javadoc and comments.
  - Procrun. The DependsOn parameter is no longer ignored when
    updating the service configuration.
  - Fix crash and provide an error level log message when the
    user attempts to start the service without configuring a
    JVM and none is available via the registry.
  * Updates:
  - Bump actions/cache from 3.0.3 to 3.0.8.
  - Bump actions/checkout from 3 to 3.0.2.
  - Bump commons-parent from 53 to 54.
  - Bump spotbugs-maven-plugin from 4.6.0.0 to 4.7.2.0.
  - Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.
  - Bump japicmp-maven-plugin from 0.15.4 to 0.16.0.
  - Bump JUnit 4 to 5 vintage.
  * Remove apache-commons-daemon-riscv64.patch already upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1683115200">- Update to 1.3.3:
  * Fixes:
  - Procrun. Follow-up to ensure all child processes are cleaned
    up if the service does not stop cleanly.
  - Procrun. Fix creation of duplicate ACL entries on some
    Windows platforms.
  * Updates:
  - Bump actions/cache from 3.0.8 to 3.0.11.
  - Bump actions/checkout from 3.0.2 to 3.1.0.
  - Bump actions/setup-java from 3.5.1 to 3.6.0.
  - Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0.</changelog>
  <changelog author="david.anes@suse.com" date="1697544000">- Update to 1.3.4:
  * Procrun. Configured stack size now applies to the main thread
    when running in JVM mode. Fixes DAEMON-451.
  * Procrun. If the specified log directory does not exist, attempt
    to create any missing parent directories, as well as the
    specified directory, when the service starts. Fixes DAEMON-452.
  * Procrun. Allow Windows service dependencies to be managed by
    Procrun or by 'sc config ...'. Fixes DAEMON-458.
  * jsvc. Fix DaemonController.reload() only working the first time
    it is called. Fixes DAEMON-459. Thanks to Klaus Malorny.
  * jsvc. Remove incorrent definition 'supported_os' which defined
    in psupport.m4 file to fix jsvc build error on riscv64.
  * Bump commons-parent from 54 to 57 #71, #91.</changelog>
  <changelog author="fstrba@suse.com" date="1707220800">- Disable LTO to avoid undefined symbols on some platforms</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1714996800">- Add apache-commons-daemon-gcc14-compat.patch for GCC 14
  compatibility.
- Correct offset in apache-commons-daemon-JAVA_OS.patch.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723464000">- Upgrade to 1.4.0
  * Fixes:
    + [StepSecurity] ci: Harden GitHub Actions #95.
    + Procrun. Enable Control Flow Guard for Windows binaries.
    Fixes DAEMON-429.
    + Procrun. Better label for command used to start service shown
    in Prunmgr.exe. Fixes DAEMON-461.
    + jsvc. Fix warnings when running support/buildconf.sh
    + jsvc. Fix compilation issue with newer compilers. Fixes
    + Procrun. Refactor UAC support so that elevation is only
    requested for actions that require administrator privileges.
  * New Features:
    + Procrun. Add support for hybrid CRT builds.
    + jsvc. Add support for LoongArch64 support #92.
  * Update dependencies:
    + Bump commons-parent from 57 to 69 #155.
    + The minimum support Java version has been upgraded from Java
    7 to Java 8.
    + Bump commons-parent from 69 to 70.
- Revise apache-commons-daemon-gcc14-compat.patch for compatibility
  with version 1.4.0</changelog>
</package>
<package pkgid="d013d537a5d98ec0d6644e46301bb9ebc1e1d792823dd1d31f711d57a172b17a" name="apache-commons-fileupload" arch="noarch">
  <version epoch="0" ver="1.6.0" rel="150200.3.12.1"/>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1750161600">- Upgrade to upstream version 1.6.0
  * Fixes bsc#1244657, CVE-2025-48976
  * New features:
    + [1.x] Enable multipart/related on FileUpload #314.
    + Add JApiCmp to the default Maven goal.
    + Add partHeaderSizeMax, a new limit that sets a maximum number
    of bytes for each individual multipart header. The default is
    512 bytes.
  * Fixed Bugs:
    + Replace use of Locale.ENGLISH with Locale.ROOT.
    + Remove unused exception from FileUploadBase.createItem(Map,
    boolean).
    + Migrate from deprecated API in DiskFileItem.getOutputStream().
    + Use try-with-resources.
    + Port to Java 1.4 Throwable APIs (!).
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + DiskFileItem.getInputStream() now uses NIO.
    + Last statement in DiskFileItem.finalize() method should be a
    call to super.finalize().
    + org.apache.commons.fileupload.FileUploadBase
    .FileUploadIOException is now a proper Java 1.4-style
    exception (propagates its cause to super).
    + Use java.util.Base64 instead of custom code.
  * Changes:
    + Bump Java from 6 to 8.
    + Bump org.apache.commons:commons-parent from 62 to 84, upgrades
    Doxia from 1 to 2.
    + Bump commons-io from 2.11.0 to 2.19.0.
    + Bump javax.servlet:servlet-api from 2.4 to 2.5.
    + Bump JUnit from junit:junit:4.13.2
    org.junit.vintage:junit-vintage-engine from parent POM.</changelog>
</package>
<package pkgid="7a175313710015d7e6e0c1675f58e7757a516d5ff51f0f3bc4b1fa9088555fa7" name="apache-commons-fileupload" arch="src">
  <version epoch="0" ver="1.6.0" rel="150200.3.12.1"/>
  <changelog author="dmueller@suse.de" date="1127908800">- add norootforbuild</changelog>
  <changelog author="jsmeix@suse.de" date="1129636800">- Current version 1.0 from JPackage.org</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="skh@suse.de" date="1158926400">- don't use icecream
- use target="1.4" for build with java 1.5</changelog>
  <changelog author="mvyskocil@suse.cz" date="1205409600">- merged with jpackage 1.7
- update to 1.1.1</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="mvyskocil@suse.com" date="1382011200">- fix bnc#846174/CVE-2013-2186: null byte injection flaw
  http://svn.apache.org/viewvc?view=revision&amp;revision=1507048
  * jakarta-commons-fileupload-CVE-2013-2186.patch</changelog>
  <changelog author="mvyskocil@suse.com" date="1382097600">- remove gcj part and deprecated macros</changelog>
  <changelog author="tchvatal@suse.com" date="1396440000">- Fix bnc#862781/CVE-2014-0050: buffer overflow
  http://svn.apache.org/viewvc?view=revision&amp;revision=1565143
  * jakarta-commons-fileupload-CVE-2014-0050-DOS-buffer-overflow.patch</changelog>
  <changelog author="darin@darins.net" date="1400155200">- disable bytecode check on sle_11
- remove removal of buildroot in %install</changelog>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1750161600">- Upgrade to upstream version 1.6.0
  * Fixes bsc#1244657, CVE-2025-48976
  * New features:
    + [1.x] Enable multipart/related on FileUpload #314.
    + Add JApiCmp to the default Maven goal.
    + Add partHeaderSizeMax, a new limit that sets a maximum number
    of bytes for each individual multipart header. The default is
    512 bytes.
  * Fixed Bugs:
    + Replace use of Locale.ENGLISH with Locale.ROOT.
    + Remove unused exception from FileUploadBase.createItem(Map,
    boolean).
    + Migrate from deprecated API in DiskFileItem.getOutputStream().
    + Use try-with-resources.
    + Port to Java 1.4 Throwable APIs (!).
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + DiskFileItem.getInputStream() now uses NIO.
    + Last statement in DiskFileItem.finalize() method should be a
    call to super.finalize().
    + org.apache.commons.fileupload.FileUploadBase
    .FileUploadIOException is now a proper Java 1.4-style
    exception (propagates its cause to super).
    + Use java.util.Base64 instead of custom code.
  * Changes:
    + Bump Java from 6 to 8.
    + Bump org.apache.commons:commons-parent from 62 to 84, upgrades
    Doxia from 1 to 2.
    + Bump commons-io from 2.11.0 to 2.19.0.
    + Bump javax.servlet:servlet-api from 2.4 to 2.5.
    + Bump JUnit from junit:junit:4.13.2
    org.junit.vintage:junit-vintage-engine from parent POM.</changelog>
</package>
<package pkgid="04fed831f71fe4f5e64725fb88ea741aac7e0ef25064587ed3e618efd332411e" name="apache-commons-fileupload-javadoc" arch="noarch">
  <version epoch="0" ver="1.6.0" rel="150200.3.12.1"/>
  <changelog author="jmatejek@suse.com" date="1403870400">- added Xerces xml-apis to dependencies to fix build</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Cleanup with spec-cleaner and fix build on sle11 properly.</changelog>
  <changelog author="tchvatal@suse.com" date="1404820801">- Not needed condition.</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Clean spec file and fix rpmlint warnings</changelog>
  <changelog author="fstrba@suse.com" date="1544184000">- Build against xml-commons-apis instead of xerces-j2-xml-apis</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Rename to apache-commons-fileupload and upgrade to version 1.4
- Generate and customize ant build.xml file</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1684843200">- Upgrade to upstream version 1.5
  * New features:
    + Add a configurable limit (disabled by default) for the number
    of files to upload per request (bsc#1208513, CVE-2023-24998).
    The new configuration option (FileUploadBase#setFileCountMax)
    is not enabled by default and must be explicitly configured.
  * Fixed Bugs:
    + FILEUPLOAD-293: DiskFileItem.write(File) had been changed to
    use FileUtils.moveFile internally, preventing an existing file
    as the target.
    + Improve parsing speed.
  * Changes:
    + Bump Commons IO to 2.11.0
    + FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco
    code coverage.
    + Bump JUnit to 4.13.2</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1750161600">- Upgrade to upstream version 1.6.0
  * Fixes bsc#1244657, CVE-2025-48976
  * New features:
    + [1.x] Enable multipart/related on FileUpload #314.
    + Add JApiCmp to the default Maven goal.
    + Add partHeaderSizeMax, a new limit that sets a maximum number
    of bytes for each individual multipart header. The default is
    512 bytes.
  * Fixed Bugs:
    + Replace use of Locale.ENGLISH with Locale.ROOT.
    + Remove unused exception from FileUploadBase.createItem(Map,
    boolean).
    + Migrate from deprecated API in DiskFileItem.getOutputStream().
    + Use try-with-resources.
    + Port to Java 1.4 Throwable APIs (!).
    + Remove -nouses directive from maven-bundle-plugin. OSGi
    package imports now state 'uses' definitions for package
    imports, this doesn't affect JPMS (from
    org.apache.commons:commons-parent:80).
    + DiskFileItem.getInputStream() now uses NIO.
    + Last statement in DiskFileItem.finalize() method should be a
    call to super.finalize().
    + org.apache.commons.fileupload.FileUploadBase
    .FileUploadIOException is now a proper Java 1.4-style
    exception (propagates its cause to super).
    + Use java.util.Base64 instead of custom code.
  * Changes:
    + Bump Java from 6 to 8.
    + Bump org.apache.commons:commons-parent from 62 to 84, upgrades
    Doxia from 1 to 2.
    + Bump commons-io from 2.11.0 to 2.19.0.
    + Bump javax.servlet:servlet-api from 2.4 to 2.5.
    + Bump JUnit from junit:junit:4.13.2
    org.junit.vintage:junit-vintage-engine from parent POM.</changelog>
</package>
<package pkgid="f4d21123f857146ab6ded46e89535c0ed08aee61bb531b2250f059fb9ce3552a" name="apache-commons-io" arch="noarch">
  <version epoch="0" ver="2.18.0" rel="150200.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Remove unused depedencies</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix build with jdk9 by specifying source and target level 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="fstrba@suse.com" date="1551182400">- Update to upstream version 2.6
  * many bugfixes, features and enhancenments, like
    Automatic-Module-Name entry in manifest
  * requires jdk7 or later
  * see RELEASE-NOTES.txt for details
- Generated a build.xml to be able to build with ant
- Build with tests is now optional
- Removed patch:
  * commons-io-version-property.patch
    + not needed anymore in this version</changelog>
  <changelog author="fstrba@suse.com" date="1553688000">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591185600">- Update to upstream version 2.7 (bsc#1184755, CVE-2021-29425)
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.7
  * Lots of bugfixes, updates and enhancements
  * Java 8 or later is required</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 2.8.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.8.0</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 2.9.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.9.0</changelog>
  <changelog author="david.anes@suse.com" date="1650369600">- Update to 2.11.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.11.0
- Update to 2.10.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.10.0</changelog>
  <changelog author="david.anes@suse.com" date="1697630400">- Update to 2.14.0:
  * Lots of new features, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0
  * Fixes bsc#1231298, CVE-2024-47554: untrusted input to XmlStreamReader
    can lead to uncontrolled resource consumption</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1708344000">- Upgrade to 2.15.1
  * Fixed Bugs:
    + Fix wrong issue id in change log
    + Add test for FileChannels.contentEquals()
    + Fix FileChannels.contentEquals()
    + Fix some Javadoc issues in LineIterator and IOUtils
    + Simplify FileAlterationObserver internal processing
    + Avoid NullPointerException in RegexFileFilter
    .RegexFileFilter(Pattern)
    + Avoid NullPointerException in RegexFileFilter
    .accept(Path, BasicFileAttributes)
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .RegexFileFilter defines non-transient non-serializable
    instance field pathToString [org.apache.commons.io.filefilter
    .RegexFileFilter] In RegexFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.filefilter
    .DelegateFileFilter] In DelegateFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileNameFilter [org.apache.commons.io
    .filefilter.DelegateFileFilter] In DelegateFileFilter.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.function.IOStream$1
    .next() cannot throw NoSuchElementException [org.apache
    .commons.io.function.IOStream$1] At IOStream.java:[line 98]
    IT_NO_SUCH_ELEMENT
    + Fix SpotBugs error: org.apache.commons.io.monitor
    .FileAlterationMonitor.getObservers() may expose internal
    representation by returning FileAlterationMonitor.observers
    [org.apache.commons.io.monitor.FileAlterationMonitor] At
    FileAlterationMonitor.java:[line 124] EI_EXPOSE_REP
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field listeners [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.FileCleaningTracker
    .getDeleteFailures() may expose internal representation by
    returning FileCleaningTracker.deleteFailures [org.apache
    .commons.io.FileCleaningTracker] At
    FileCleaningTracker.java:[line 218] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList() may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 118]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList(Class) may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 129]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getDirList() may expose internal
    representation by returning AccumulatorPathVisitor.dirList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 179] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getFileList() may expose internal
    representation by returning AccumulatorPathVisitor.fileList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 188] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.input
    .ObservableInputStream.getObservers() may expose internal
    representation by returning ObservableInputStream.observers
    [org.apache.commons.io.input.ObservableInputStream] At
    ObservableInputStream.java:[line 187] EI_EXPOSE_REP
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int) will leave
    the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 202]
    CT_CONSTRUCTOR_THROW
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int, int) will
    leave the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 223]
    CT_CONSTRUCTOR_THROW
- Upgrade to 2.15.0
  * New features:
    + Add org.apache.commons.io.channels.FileChannels
    + Add RandomAccessFiles#contentEquals(RandomAccessFile,
    RandomAccessFile)
    + Add RandomAccessFiles#reset(RandomAccessFile)
    + Add PathUtilsContentEqualsBenchmark
    + Add org.apache.commons.io.StreamIterator
    + Add MessageDigestInputStream and deprecate
    MessageDigestCalculatingInputStream
  * Fixed Bugs:
    + IO-815: XmlStreamReader encoding match RE is too strict
    + IO-810: Javadoc in FileUtils does not reflect code for thrown
    exceptions
    + IO-812: Javadoc should mention closing Streams based on file
    resources
    + IO-811: In tests, Files.walk() direct and indirect callers
    fail to close the returned Stream
    + IO-811: FileUtils.listFiles(File, String[], boolean) fails to
    close its internal Stream
    + IO-811: FileUtils.iterateFiles(File, String[], boolean) fails
    to close its internal Stream
    + IO-811: StreamIterator fails to close its internal Stream
    + IO-814: Don't throw UncheckedIOException
    + IO-414: Don't write a BOM on every (or any) line
    + IO-814: RandomAccessFileMode.create(Path) provides a better
    NullPointerException message
    + Improve performance of PathUtils.fileContentEquals(Path, Path,
    LinkOption[], OpenOption[]) by about 60%, see
    PathUtilsContentEqualsBenchmark
    + Improve performance of PathUtils.fileContentEquals(Path, Path)
    by about 60%, see PathUtilsContentEqualsBenchmark
    + Improve performance of FileUtils.contentEquals(File, File) by
    about 60%, see PathUtilsContentEqualsBenchmark
    + Remove unused test code
    + [Javadoc] IOUtils#contentEquals does not throw
    NullPointerException
    + Fix CodeQL warnings in UnsynchronizedBufferedInputStream:
    Implicit narrowing conversion in compound assignment
    + MessageDigestCalculatingInputStream
    .MessageDigestMaintainingObserver
    .MessageDigestMaintainingObserver(MessageDigest) now throws a
    NullPointerException if the MessageDigest is null
    + MessageDigestCalculatingInputStream
    .MessageDigestCalculatingInputStream(InputStream,
    MessageDigest) now throws a NullPointerException if the
    MessageDigest is null
    + IO-816: UnsynchronizedBufferedInputStream.read(byte[], int,
    int) does not use buffer</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Upgrade to 2.16.1
  * Fixes:
    + Reimplement FileSystemUtils using NIO.
    + FileSystemUtils no longer throws IllegalStateException. Fixes
    IO-851.
    + Avoid possible NullPointerException in
    FileUtils.listAccumulate(File, IOFileFilter, IOFileFilter,
    FileVisitOption...).
    + BoundedInputStream.reset() not updating count. Fixes IO-853.
    + ThresholdingOutputStream: a negative threshold should behave
    like a zero threshold and trigger the event on the first
    write #609. Fixes IO-854.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.12 to 1.14.13 #605.
    + Bump org.apache.commons:commons-parent from 67 to 69 #608.
- Update apache-commons-io-build.xml for new version
- Includes changes from 2.16.0
  * Fixes:
    + Fix and re-enable testSkip_RequiredCharsets #518.
    + SymbolicLineFileFilter documentation fixes. Fixes IO-824.
    + CharSequenceInputStream.reset() only works once #520. Fixes
    IO-795.
    + Finish TODO on CharSequenceInputStream #540. Fixes IO-795.
    + Add byte array size validation for methods in EndianUtils
    [#521]. Fixes IO-825.
    + Add missing test case CircularByteBufferTest. Fixes IO-825.
    + Make CharSequenceInputStream.available() more correct in the
    face of multibyte encodings #525. Fixes IO-781.
    + Remove unreachable code in AbstractIOFileFilterTest #526.
    Fixes IO-781.
    + Rationalize and unify checking for existence of files and
    directories #529. Fixes IO-808.
    + Avoid NullPointerException in IOCase.checkEquals(String,
    String) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(Path, BasicFileAttributes) on
    null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(Path, BasicFileAttributes) on null
    input.
    + Avoid NullPointerException in EmptyFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in EmptyFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in FileFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in FileFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in IOCase.checkIndexOf(String,
    int, String) on null input.
    + Avoid NullPointerException in
    IOCase.checkRegionMatches(String, int, String) on null input.
    + BoundedInputStream.getCount() should not count EOF.
    + Modernize temporary file creation and deletion in
    DeferredFileOutputStreamTest #535.
    + Add PathMatcher to IOFileFilter class Javadoc #536.
    + Fix CharSequenceInputStream coding exception handling #537.
    Fixes IO-781.
    + Deprecate int CountingInputStream#getCount() in favor of long
    CountingInputStream#getByteCount(). Fixes IO-781.
    + Deprecate CountingInputStream.resetCount() in favor of
    resetByteCount(). Fixes IO-828.
    + Deprecate CountingInputStream.getMaxLength() in favor of
    getMaxCount()). Fixes IO-828.
    + NullInputStream breaks InputStream's read method contract.
    Fixes IO-818.
    + Javadoc shouldn't reference 1.x behavior #539.
    + Don't decode and reencode characters in a potentially
    different charset in
    AbstractOrigin.CharSequenceOrigin.getReader(Charset). Fixes
    IO-829.
    + Let subclasses of CountingInputStream.afterRead(int) throw
    IOException.
    + Characterization test for broken symlinks when copying
    directories #547. Fixes IO-807.
    + ClosedInputStream.read(byte[], int, int) does not always
    return -1.
    + ClosedOutputStream.write(byte[], int, int) does not always
    throw IOException.
    + XmlStreamReader can't parse an XML document with a multi-line
    prolog #550.
    + XmlStreamReader can't parse XML an document with an external
    parsed entity prolog.
    + Update FileNameUtils Javadoc #554. Fixes IO-836.
    + Copy symlinks, not the files the symlinks point to #558.
    Fixes IO-807.
    + Pickup apache-rat-plugin version from parent POM.
    + Add test for copying a symlink
    FileUtilsTest#testCopyFile_symLink() #564.
    + Make copyFile copy symbolic links by value rather than
    reference #565.
    + Deprecate CopyUtils 0-argument constructor.
    + Deprecate EndianUtils 0-argument constructor. Fixes IO-843.
    + Deprecate FileSystemUtils 0-argument constructor.
    + Deprecate FilenameUtils 0-argument constructor.
    + Deprecate RandomAccessFiles 0-argument constructor.
    + Clarify and correct EndianUtils and SwappedDataInputStream
    API doc #566.
    + Add characterization test for copying a symlinked directory
    [#570].
    + RandomAccessFileInputStream.builder().get() now throws ISE
    instead of NPE.
    + Test links to targets outside the source directory #571.
    Fixes IO-845.
    + Focus Javadoc on current version rather than past versions
    [#573], #574.
    + "Self-suppression not permitted" while using BrokenOutput and
    BrokenInput streams with try-with-resources. Fixes IO-469.
    + Handle zero and negative thresholds #587. Fixes IO-405.
    + Deprecate CountingInputStream in favor of BoundedInputStream.
    + PathUtils.setPosixPermissions(...) only sets permissions if
    needed.
    + PathUtils.setReadOnly(...) only sets permissions if needed.
    + PathUtils.deleteFile(..., DeleteOption...) only sets
    permissions if needed.
    + CleaningPathVisitor only sets permissions if needed.
    + DeletingPathVisitor only sets permissions if needed.
  * New features:
    + Add and use PathUtils.getFileName(Path, Function&lt;Path, R&gt;).
    + Add and use PathUtils.getFileNameString().
    + Make public Erase.rethrow(Throwable).
    + Add BrokenInputStream.BrokenInputStream(Throwable). Fixes
    IO-826.
    + Add BrokenReader.BrokenReader(Throwable). Fixes IO-826.
    + Add BrokenOutputStream.BrokenOutputStream(Throwable). Fixes
    IO-826.
    + Add BrokenWriter.BrokenWriter(Throwable). Fixes IO-826.
    + Add BoundedInputStream.getRemaining().
    + Add FileTimes.toNtfsTime(long).
    + Add FileTimes.fromUnixTime(long).
    + Add FileTimes.isUnixTime(FileTime).
    + Add FileTimes.isUnixTime(long).
    + Add FileTimes.toUnixTime(FileTime).
    + Add BrokenInputStream.Builder.
    + Add PathUtils.getExtension(Path).
    + Add PathUtils.getBaseName(Path).
    + Add ThrottledInputStream.
    + Add IORunnable.noop().
    + Add ChecksumInputStream and test #548.
    + Add AbstractStreamBuilder.getReader().
    + Add Maven property project.build.outputTimestamp for build
    reproducibility.
    + Add ProxyInputStream.unwrap().
    + Add a running count and builder to BoundedInputStream.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.10 to 1.14.12 #534,
    [#592].
    + Bump org.apache.commons:commons-parent from 65 to 67.
    + Bump commons-codec:commons-codec from 1.16.0 to 1.16.1 #583.
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.1.1 to 3.2.0
    [#593].</changelog>
  <changelog author="fstrba@suse.com" date="1728043200">- Upgrade to 2.17.0
  * New features:
    + Add IOIterator.adapt(Iterable)
    + Add getInputStream() for 'https' and 'http' in URIOrigin
    [#630]. Fixes IO-831
    + Add IOSupplier.getUnchecked()
    + Add CloseShieldInputStream.systemIn(InputStream)
    + Add NullInputStream.init()
    + Add AbstractInputStream and refactor duplicate code
    + Add UnsynchronizedReader
    + Add UnsynchronizedBufferedReader
  * Fixes:
    + FileUtilsWaitForTest does not test anything useful.
    Fixes IO-858.
    + Add missing unit tests
    + FileUtils.lastModifiedFileTime(File) calls
    Objects.requireNonNull() on the wrong object
    + PathUtils.deleteOnExit(Path) calls Objects.requireNonNull()
    on the wrong object
    + Deprecate LineIterator.nextLine() in favor of next()
    + Fix PMD UnnecessaryFullyQualifiedName
    + Add test for CircularByteBuffer clear() #620
    + PathUtils.isPosix(Path, LinkOption...) should return false on
    null input
    + AutoCloseInputStream(InputStream) uses
    ClosedInputStream.INSTANCE when its input is null
    + Avoid NullPointerException in ProxyInputStream.available()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.markSupported()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.mark(int) when
    the underlying input stream is null
    + BufferedFileChannelInputStream.available() returns 0 before
    any reads
    + BufferedFileChannelInputStream.available() should return 0
    instead of -1 at the end of the stream
    + BufferedFileChannelInputStream.available() should return 0
    when the stream is closed instead of throwing an exception
    + CharSequenceInputStream.available() should return 0 after the
    stream is closed
    + BoundedInputStream.available() should return 0 when the
    stream is closed
    + CircularInputStream.available() should return 0 when the
    stream is closed
    + InfiniteCircularInputStream.available() should return 0 when
    the stream is closed
    + ChecksumInputStream(InputStream, Checksum, long, long) should
    fail-fast on null Checksum input
    + Deprecate NullInputStream.INSTANCE in favor of constructors
    + NullInputStream.available() should return 0 after the stream
    is closed
    + MemoryMappedFileInputStream.available() should return 0 after
    the stream is closed
    + RandomAccessFileInputStream.available() should return 0 after
    the stream is closed
    + ReaderInputStream.available() should return 0 after the
    stream is closed
    + AutoCloseInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + BoundedInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + NullInputStream.read(*) should throw IOException when it is
    closed
    + NullInputStream.read(byte[]) should return 0 when the input
    byte array in length 0
    + NullInputStream.read(byte[], int, int) should return 0 when
    the input byte array in length 0 or requested length is 0
    + MarkShieldInputStream.read(*) should throw IOException when
    it is closed
    + Replace deprecated constant FileFileFilter.FILE in Javadoc
    [#657]
    + Pick up exec-maven-plugin version from parent POM
  * Updates:
    + Bump tests commons.bytebuddy.version from 1.14.13 to 1.15.1
    [#615], #621, #631, #635, #642, #658, #663, #665
    + Bump tests commons-codec:commons-codec from 1.16.1 to 1.17.1
    [#644]
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.4.1
    [#632], #652, #659
    + Bump org.apache.commons:commons-parent from 69 to 74 #628,
    [#637], #649, #661, #664
    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0
    [#645], #653, #666</changelog>
  <changelog author="gus.kenion@suse.com" date="1737720000">- Upgrade to 2.18.0
  * New features
    + Add @FunctionalInterface to ClassNameMatcher.
    + Add ValidatingObjectInputStream.Builder and
    ValidatingObjectInputStream.builder().
    + Add a "Safe Deserialization" section to the User Guide for
    the site.
    + Add IORandomAccessFile.
    + Add RandomAccessFileMode.io(String).
    + Add FileAlterationObserver.Builder() and deprecate most
    constructors.
    + Add IOUtils.readLines(CharSequence).
    + Add ValidatingObjectInputStream.ObjectStreamClassPredicate to
    allow configuration reuse.
    + Add RandomAccessFileMode.accept(Path,
    IOConsumer&lt;RandomAccessFile&gt;).
    + Add RandomAccessFileMode.apply(Path,
    IOFunction&lt;RandomAccessFile&gt;, T).
    + Add IOIntConsumer.
    + Add ProxyInputStream.AbstractBuilder. Supports setting a
    consumer for ProxyInputStream.afterRead(int).
    + Add support to AutoCloseInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to BOMInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    BoundedInputStream.onMaxLength(long, long).
    + Add support to ChecksumInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to ThrottledInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to ObservableInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestCalculatingInputStream for
    setting a consumer for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestInputStream for setting a
    consumer for ProxyInputStream.afterRead(int).
  * Fixed Bugs
    + Clean ups in unit tests.
    + Fix some Javadoc issues.
    + RandomAccessFileMode.toString() is more helpful for debugging
    when it inherits from Enum.
    + Fix implicit narrowing conversion in compound assignment in
    UnsynchronizedBufferedReader.skip(long).
    + IO-860:  Missing reserved file names in FileSystem.WINDOWS
    (superscript digits for COM and LPT).
    + IO-856:  FileUtils.listFiles(final File, String[], boolean)
    can throw NoSuchFileException #697, #699.
    + IO-859:  FileUtils.forceDelete on non-existent file on Windows
    throws IOException rather than FileNotFoundException.
    + Use Unicode escapes for superscript characters. #701.
    + IO-863:  Recent incompatible change to FileUtils.listFiles re
    extensions, see also IO-856.
    + IO-857:  Javadoc: Update details for PathUtils "clean"
    behavior.
  * Changes
    + Bump org.apache.commons:commons-parent from 74 to 78 #670,
    [#676], #679, #688.
    + Bump commons.bytebuddy.version from 1.15.1 to 1.15.10 #672,
    [#673], #685, #686, #694, #696, #698.
    + Update AbstractStreamBuilder getters from protected to
    public.</changelog>
</package>
<package pkgid="fbdd23dcbd8967a32a62feb9274796cde7fe4993370ba7457ca3a88a96f9fc20" name="apache-commons-io" arch="src">
  <version epoch="0" ver="2.18.0" rel="150200.3.15.1"/>
  <changelog author="mmeister@suse.com" date="1363780800">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1404734400">- Use junit not junit4</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Remove unused depedencies</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix build with jdk9 by specifying source and target level 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="fstrba@suse.com" date="1551182400">- Update to upstream version 2.6
  * many bugfixes, features and enhancenments, like
    Automatic-Module-Name entry in manifest
  * requires jdk7 or later
  * see RELEASE-NOTES.txt for details
- Generated a build.xml to be able to build with ant
- Build with tests is now optional
- Removed patch:
  * commons-io-version-property.patch
    + not needed anymore in this version</changelog>
  <changelog author="fstrba@suse.com" date="1553688000">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591185600">- Update to upstream version 2.7 (bsc#1184755, CVE-2021-29425)
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.7
  * Lots of bugfixes, updates and enhancements
  * Java 8 or later is required</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 2.8.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.8.0</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 2.9.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.9.0</changelog>
  <changelog author="david.anes@suse.com" date="1650369600">- Update to 2.11.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.11.0
- Update to 2.10.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.10.0</changelog>
  <changelog author="david.anes@suse.com" date="1697630400">- Update to 2.14.0:
  * Lots of new features, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0
  * Fixes bsc#1231298, CVE-2024-47554: untrusted input to XmlStreamReader
    can lead to uncontrolled resource consumption</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1708344000">- Upgrade to 2.15.1
  * Fixed Bugs:
    + Fix wrong issue id in change log
    + Add test for FileChannels.contentEquals()
    + Fix FileChannels.contentEquals()
    + Fix some Javadoc issues in LineIterator and IOUtils
    + Simplify FileAlterationObserver internal processing
    + Avoid NullPointerException in RegexFileFilter
    .RegexFileFilter(Pattern)
    + Avoid NullPointerException in RegexFileFilter
    .accept(Path, BasicFileAttributes)
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .RegexFileFilter defines non-transient non-serializable
    instance field pathToString [org.apache.commons.io.filefilter
    .RegexFileFilter] In RegexFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.filefilter
    .DelegateFileFilter] In DelegateFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileNameFilter [org.apache.commons.io
    .filefilter.DelegateFileFilter] In DelegateFileFilter.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.function.IOStream$1
    .next() cannot throw NoSuchElementException [org.apache
    .commons.io.function.IOStream$1] At IOStream.java:[line 98]
    IT_NO_SUCH_ELEMENT
    + Fix SpotBugs error: org.apache.commons.io.monitor
    .FileAlterationMonitor.getObservers() may expose internal
    representation by returning FileAlterationMonitor.observers
    [org.apache.commons.io.monitor.FileAlterationMonitor] At
    FileAlterationMonitor.java:[line 124] EI_EXPOSE_REP
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field listeners [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.FileCleaningTracker
    .getDeleteFailures() may expose internal representation by
    returning FileCleaningTracker.deleteFailures [org.apache
    .commons.io.FileCleaningTracker] At
    FileCleaningTracker.java:[line 218] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList() may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 118]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList(Class) may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 129]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getDirList() may expose internal
    representation by returning AccumulatorPathVisitor.dirList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 179] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getFileList() may expose internal
    representation by returning AccumulatorPathVisitor.fileList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 188] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.input
    .ObservableInputStream.getObservers() may expose internal
    representation by returning ObservableInputStream.observers
    [org.apache.commons.io.input.ObservableInputStream] At
    ObservableInputStream.java:[line 187] EI_EXPOSE_REP
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int) will leave
    the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 202]
    CT_CONSTRUCTOR_THROW
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int, int) will
    leave the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 223]
    CT_CONSTRUCTOR_THROW
- Upgrade to 2.15.0
  * New features:
    + Add org.apache.commons.io.channels.FileChannels
    + Add RandomAccessFiles#contentEquals(RandomAccessFile,
    RandomAccessFile)
    + Add RandomAccessFiles#reset(RandomAccessFile)
    + Add PathUtilsContentEqualsBenchmark
    + Add org.apache.commons.io.StreamIterator
    + Add MessageDigestInputStream and deprecate
    MessageDigestCalculatingInputStream
  * Fixed Bugs:
    + IO-815: XmlStreamReader encoding match RE is too strict
    + IO-810: Javadoc in FileUtils does not reflect code for thrown
    exceptions
    + IO-812: Javadoc should mention closing Streams based on file
    resources
    + IO-811: In tests, Files.walk() direct and indirect callers
    fail to close the returned Stream
    + IO-811: FileUtils.listFiles(File, String[], boolean) fails to
    close its internal Stream
    + IO-811: FileUtils.iterateFiles(File, String[], boolean) fails
    to close its internal Stream
    + IO-811: StreamIterator fails to close its internal Stream
    + IO-814: Don't throw UncheckedIOException
    + IO-414: Don't write a BOM on every (or any) line
    + IO-814: RandomAccessFileMode.create(Path) provides a better
    NullPointerException message
    + Improve performance of PathUtils.fileContentEquals(Path, Path,
    LinkOption[], OpenOption[]) by about 60%, see
    PathUtilsContentEqualsBenchmark
    + Improve performance of PathUtils.fileContentEquals(Path, Path)
    by about 60%, see PathUtilsContentEqualsBenchmark
    + Improve performance of FileUtils.contentEquals(File, File) by
    about 60%, see PathUtilsContentEqualsBenchmark
    + Remove unused test code
    + [Javadoc] IOUtils#contentEquals does not throw
    NullPointerException
    + Fix CodeQL warnings in UnsynchronizedBufferedInputStream:
    Implicit narrowing conversion in compound assignment
    + MessageDigestCalculatingInputStream
    .MessageDigestMaintainingObserver
    .MessageDigestMaintainingObserver(MessageDigest) now throws a
    NullPointerException if the MessageDigest is null
    + MessageDigestCalculatingInputStream
    .MessageDigestCalculatingInputStream(InputStream,
    MessageDigest) now throws a NullPointerException if the
    MessageDigest is null
    + IO-816: UnsynchronizedBufferedInputStream.read(byte[], int,
    int) does not use buffer</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Upgrade to 2.16.1
  * Fixes:
    + Reimplement FileSystemUtils using NIO.
    + FileSystemUtils no longer throws IllegalStateException. Fixes
    IO-851.
    + Avoid possible NullPointerException in
    FileUtils.listAccumulate(File, IOFileFilter, IOFileFilter,
    FileVisitOption...).
    + BoundedInputStream.reset() not updating count. Fixes IO-853.
    + ThresholdingOutputStream: a negative threshold should behave
    like a zero threshold and trigger the event on the first
    write #609. Fixes IO-854.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.12 to 1.14.13 #605.
    + Bump org.apache.commons:commons-parent from 67 to 69 #608.
- Update apache-commons-io-build.xml for new version
- Includes changes from 2.16.0
  * Fixes:
    + Fix and re-enable testSkip_RequiredCharsets #518.
    + SymbolicLineFileFilter documentation fixes. Fixes IO-824.
    + CharSequenceInputStream.reset() only works once #520. Fixes
    IO-795.
    + Finish TODO on CharSequenceInputStream #540. Fixes IO-795.
    + Add byte array size validation for methods in EndianUtils
    [#521]. Fixes IO-825.
    + Add missing test case CircularByteBufferTest. Fixes IO-825.
    + Make CharSequenceInputStream.available() more correct in the
    face of multibyte encodings #525. Fixes IO-781.
    + Remove unreachable code in AbstractIOFileFilterTest #526.
    Fixes IO-781.
    + Rationalize and unify checking for existence of files and
    directories #529. Fixes IO-808.
    + Avoid NullPointerException in IOCase.checkEquals(String,
    String) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(Path, BasicFileAttributes) on
    null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(Path, BasicFileAttributes) on null
    input.
    + Avoid NullPointerException in EmptyFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in EmptyFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in FileFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in FileFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in IOCase.checkIndexOf(String,
    int, String) on null input.
    + Avoid NullPointerException in
    IOCase.checkRegionMatches(String, int, String) on null input.
    + BoundedInputStream.getCount() should not count EOF.
    + Modernize temporary file creation and deletion in
    DeferredFileOutputStreamTest #535.
    + Add PathMatcher to IOFileFilter class Javadoc #536.
    + Fix CharSequenceInputStream coding exception handling #537.
    Fixes IO-781.
    + Deprecate int CountingInputStream#getCount() in favor of long
    CountingInputStream#getByteCount(). Fixes IO-781.
    + Deprecate CountingInputStream.resetCount() in favor of
    resetByteCount(). Fixes IO-828.
    + Deprecate CountingInputStream.getMaxLength() in favor of
    getMaxCount()). Fixes IO-828.
    + NullInputStream breaks InputStream's read method contract.
    Fixes IO-818.
    + Javadoc shouldn't reference 1.x behavior #539.
    + Don't decode and reencode characters in a potentially
    different charset in
    AbstractOrigin.CharSequenceOrigin.getReader(Charset). Fixes
    IO-829.
    + Let subclasses of CountingInputStream.afterRead(int) throw
    IOException.
    + Characterization test for broken symlinks when copying
    directories #547. Fixes IO-807.
    + ClosedInputStream.read(byte[], int, int) does not always
    return -1.
    + ClosedOutputStream.write(byte[], int, int) does not always
    throw IOException.
    + XmlStreamReader can't parse an XML document with a multi-line
    prolog #550.
    + XmlStreamReader can't parse XML an document with an external
    parsed entity prolog.
    + Update FileNameUtils Javadoc #554. Fixes IO-836.
    + Copy symlinks, not the files the symlinks point to #558.
    Fixes IO-807.
    + Pickup apache-rat-plugin version from parent POM.
    + Add test for copying a symlink
    FileUtilsTest#testCopyFile_symLink() #564.
    + Make copyFile copy symbolic links by value rather than
    reference #565.
    + Deprecate CopyUtils 0-argument constructor.
    + Deprecate EndianUtils 0-argument constructor. Fixes IO-843.
    + Deprecate FileSystemUtils 0-argument constructor.
    + Deprecate FilenameUtils 0-argument constructor.
    + Deprecate RandomAccessFiles 0-argument constructor.
    + Clarify and correct EndianUtils and SwappedDataInputStream
    API doc #566.
    + Add characterization test for copying a symlinked directory
    [#570].
    + RandomAccessFileInputStream.builder().get() now throws ISE
    instead of NPE.
    + Test links to targets outside the source directory #571.
    Fixes IO-845.
    + Focus Javadoc on current version rather than past versions
    [#573], #574.
    + "Self-suppression not permitted" while using BrokenOutput and
    BrokenInput streams with try-with-resources. Fixes IO-469.
    + Handle zero and negative thresholds #587. Fixes IO-405.
    + Deprecate CountingInputStream in favor of BoundedInputStream.
    + PathUtils.setPosixPermissions(...) only sets permissions if
    needed.
    + PathUtils.setReadOnly(...) only sets permissions if needed.
    + PathUtils.deleteFile(..., DeleteOption...) only sets
    permissions if needed.
    + CleaningPathVisitor only sets permissions if needed.
    + DeletingPathVisitor only sets permissions if needed.
  * New features:
    + Add and use PathUtils.getFileName(Path, Function&lt;Path, R&gt;).
    + Add and use PathUtils.getFileNameString().
    + Make public Erase.rethrow(Throwable).
    + Add BrokenInputStream.BrokenInputStream(Throwable). Fixes
    IO-826.
    + Add BrokenReader.BrokenReader(Throwable). Fixes IO-826.
    + Add BrokenOutputStream.BrokenOutputStream(Throwable). Fixes
    IO-826.
    + Add BrokenWriter.BrokenWriter(Throwable). Fixes IO-826.
    + Add BoundedInputStream.getRemaining().
    + Add FileTimes.toNtfsTime(long).
    + Add FileTimes.fromUnixTime(long).
    + Add FileTimes.isUnixTime(FileTime).
    + Add FileTimes.isUnixTime(long).
    + Add FileTimes.toUnixTime(FileTime).
    + Add BrokenInputStream.Builder.
    + Add PathUtils.getExtension(Path).
    + Add PathUtils.getBaseName(Path).
    + Add ThrottledInputStream.
    + Add IORunnable.noop().
    + Add ChecksumInputStream and test #548.
    + Add AbstractStreamBuilder.getReader().
    + Add Maven property project.build.outputTimestamp for build
    reproducibility.
    + Add ProxyInputStream.unwrap().
    + Add a running count and builder to BoundedInputStream.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.10 to 1.14.12 #534,
    [#592].
    + Bump org.apache.commons:commons-parent from 65 to 67.
    + Bump commons-codec:commons-codec from 1.16.0 to 1.16.1 #583.
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.1.1 to 3.2.0
    [#593].</changelog>
  <changelog author="fstrba@suse.com" date="1728043200">- Upgrade to 2.17.0
  * New features:
    + Add IOIterator.adapt(Iterable)
    + Add getInputStream() for 'https' and 'http' in URIOrigin
    [#630]. Fixes IO-831
    + Add IOSupplier.getUnchecked()
    + Add CloseShieldInputStream.systemIn(InputStream)
    + Add NullInputStream.init()
    + Add AbstractInputStream and refactor duplicate code
    + Add UnsynchronizedReader
    + Add UnsynchronizedBufferedReader
  * Fixes:
    + FileUtilsWaitForTest does not test anything useful.
    Fixes IO-858.
    + Add missing unit tests
    + FileUtils.lastModifiedFileTime(File) calls
    Objects.requireNonNull() on the wrong object
    + PathUtils.deleteOnExit(Path) calls Objects.requireNonNull()
    on the wrong object
    + Deprecate LineIterator.nextLine() in favor of next()
    + Fix PMD UnnecessaryFullyQualifiedName
    + Add test for CircularByteBuffer clear() #620
    + PathUtils.isPosix(Path, LinkOption...) should return false on
    null input
    + AutoCloseInputStream(InputStream) uses
    ClosedInputStream.INSTANCE when its input is null
    + Avoid NullPointerException in ProxyInputStream.available()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.markSupported()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.mark(int) when
    the underlying input stream is null
    + BufferedFileChannelInputStream.available() returns 0 before
    any reads
    + BufferedFileChannelInputStream.available() should return 0
    instead of -1 at the end of the stream
    + BufferedFileChannelInputStream.available() should return 0
    when the stream is closed instead of throwing an exception
    + CharSequenceInputStream.available() should return 0 after the
    stream is closed
    + BoundedInputStream.available() should return 0 when the
    stream is closed
    + CircularInputStream.available() should return 0 when the
    stream is closed
    + InfiniteCircularInputStream.available() should return 0 when
    the stream is closed
    + ChecksumInputStream(InputStream, Checksum, long, long) should
    fail-fast on null Checksum input
    + Deprecate NullInputStream.INSTANCE in favor of constructors
    + NullInputStream.available() should return 0 after the stream
    is closed
    + MemoryMappedFileInputStream.available() should return 0 after
    the stream is closed
    + RandomAccessFileInputStream.available() should return 0 after
    the stream is closed
    + ReaderInputStream.available() should return 0 after the
    stream is closed
    + AutoCloseInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + BoundedInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + NullInputStream.read(*) should throw IOException when it is
    closed
    + NullInputStream.read(byte[]) should return 0 when the input
    byte array in length 0
    + NullInputStream.read(byte[], int, int) should return 0 when
    the input byte array in length 0 or requested length is 0
    + MarkShieldInputStream.read(*) should throw IOException when
    it is closed
    + Replace deprecated constant FileFileFilter.FILE in Javadoc
    [#657]
    + Pick up exec-maven-plugin version from parent POM
  * Updates:
    + Bump tests commons.bytebuddy.version from 1.14.13 to 1.15.1
    [#615], #621, #631, #635, #642, #658, #663, #665
    + Bump tests commons-codec:commons-codec from 1.16.1 to 1.17.1
    [#644]
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.4.1
    [#632], #652, #659
    + Bump org.apache.commons:commons-parent from 69 to 74 #628,
    [#637], #649, #661, #664
    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0
    [#645], #653, #666</changelog>
  <changelog author="gus.kenion@suse.com" date="1737720000">- Upgrade to 2.18.0
  * New features
    + Add @FunctionalInterface to ClassNameMatcher.
    + Add ValidatingObjectInputStream.Builder and
    ValidatingObjectInputStream.builder().
    + Add a "Safe Deserialization" section to the User Guide for
    the site.
    + Add IORandomAccessFile.
    + Add RandomAccessFileMode.io(String).
    + Add FileAlterationObserver.Builder() and deprecate most
    constructors.
    + Add IOUtils.readLines(CharSequence).
    + Add ValidatingObjectInputStream.ObjectStreamClassPredicate to
    allow configuration reuse.
    + Add RandomAccessFileMode.accept(Path,
    IOConsumer&lt;RandomAccessFile&gt;).
    + Add RandomAccessFileMode.apply(Path,
    IOFunction&lt;RandomAccessFile&gt;, T).
    + Add IOIntConsumer.
    + Add ProxyInputStream.AbstractBuilder. Supports setting a
    consumer for ProxyInputStream.afterRead(int).
    + Add support to AutoCloseInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to BOMInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    BoundedInputStream.onMaxLength(long, long).
    + Add support to ChecksumInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to ThrottledInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to ObservableInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestCalculatingInputStream for
    setting a consumer for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestInputStream for setting a
    consumer for ProxyInputStream.afterRead(int).
  * Fixed Bugs
    + Clean ups in unit tests.
    + Fix some Javadoc issues.
    + RandomAccessFileMode.toString() is more helpful for debugging
    when it inherits from Enum.
    + Fix implicit narrowing conversion in compound assignment in
    UnsynchronizedBufferedReader.skip(long).
    + IO-860:  Missing reserved file names in FileSystem.WINDOWS
    (superscript digits for COM and LPT).
    + IO-856:  FileUtils.listFiles(final File, String[], boolean)
    can throw NoSuchFileException #697, #699.
    + IO-859:  FileUtils.forceDelete on non-existent file on Windows
    throws IOException rather than FileNotFoundException.
    + Use Unicode escapes for superscript characters. #701.
    + IO-863:  Recent incompatible change to FileUtils.listFiles re
    extensions, see also IO-856.
    + IO-857:  Javadoc: Update details for PathUtils "clean"
    behavior.
  * Changes
    + Bump org.apache.commons:commons-parent from 74 to 78 #670,
    [#676], #679, #688.
    + Bump commons.bytebuddy.version from 1.15.1 to 1.15.10 #672,
    [#673], #685, #686, #694, #696, #698.
    + Update AbstractStreamBuilder getters from protected to
    public.</changelog>
</package>
<package pkgid="1b26d1bffce483f853c4046dbc98c8d19916eae5a308f24d4ef967858429f23d" name="apache-commons-io-javadoc" arch="noarch">
  <version epoch="0" ver="2.18.0" rel="150200.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="tchvatal@suse.com" date="1495368000">- Remove unused depedencies</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Fix build with jdk9 by specifying source and target level 1.6</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility
- Run fdupes on documentation</changelog>
  <changelog author="fstrba@suse.com" date="1551182400">- Update to upstream version 2.6
  * many bugfixes, features and enhancenments, like
    Automatic-Module-Name entry in manifest
  * requires jdk7 or later
  * see RELEASE-NOTES.txt for details
- Generated a build.xml to be able to build with ant
- Build with tests is now optional
- Removed patch:
  * commons-io-version-property.patch
    + not needed anymore in this version</changelog>
  <changelog author="fstrba@suse.com" date="1553688000">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1591185600">- Update to upstream version 2.7 (bsc#1184755, CVE-2021-29425)
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.7
  * Lots of bugfixes, updates and enhancements
  * Java 8 or later is required</changelog>
  <changelog author="pmonreal@suse.com" date="1603800000">- Update to 2.8.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.8.0</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 2.9.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.9.0</changelog>
  <changelog author="david.anes@suse.com" date="1650369600">- Update to 2.11.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.11.0
- Update to 2.10.0
  * Lots of added functions, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.10.0</changelog>
  <changelog author="david.anes@suse.com" date="1697630400">- Update to 2.14.0:
  * Lots of new features, fixes and updates.
  * https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0
  * Fixes bsc#1231298, CVE-2024-47554: untrusted input to XmlStreamReader
    can lead to uncontrolled resource consumption</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1708344000">- Upgrade to 2.15.1
  * Fixed Bugs:
    + Fix wrong issue id in change log
    + Add test for FileChannels.contentEquals()
    + Fix FileChannels.contentEquals()
    + Fix some Javadoc issues in LineIterator and IOUtils
    + Simplify FileAlterationObserver internal processing
    + Avoid NullPointerException in RegexFileFilter
    .RegexFileFilter(Pattern)
    + Avoid NullPointerException in RegexFileFilter
    .accept(Path, BasicFileAttributes)
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .RegexFileFilter defines non-transient non-serializable
    instance field pathToString [org.apache.commons.io.filefilter
    .RegexFileFilter] In RegexFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.filefilter
    .DelegateFileFilter] In DelegateFileFilter.java SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.filefilter
    .DelegateFileFilter defines non-transient non-serializable
    instance field fileNameFilter [org.apache.commons.io
    .filefilter.DelegateFileFilter] In DelegateFileFilter.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.function.IOStream$1
    .next() cannot throw NoSuchElementException [org.apache
    .commons.io.function.IOStream$1] At IOStream.java:[line 98]
    IT_NO_SUCH_ELEMENT
    + Fix SpotBugs error: org.apache.commons.io.monitor
    .FileAlterationMonitor.getObservers() may expose internal
    representation by returning FileAlterationMonitor.observers
    [org.apache.commons.io.monitor.FileAlterationMonitor] At
    FileAlterationMonitor.java:[line 124] EI_EXPOSE_REP
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field fileFilter [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: Class org.apache.commons.io.monitor
    .FileAlterationObserver defines non-transient non-serializable
    instance field listeners [org.apache.commons.io.monitor
    .FileAlterationObserver] In FileAlterationObserver.java
    SE_BAD_FIELD
    + Fix SpotBugs error: org.apache.commons.io.FileCleaningTracker
    .getDeleteFailures() may expose internal representation by
    returning FileCleaningTracker.deleteFailures [org.apache
    .commons.io.FileCleaningTracker] At
    FileCleaningTracker.java:[line 218] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList() may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 118]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.IOExceptionList
    .getCauseList(Class) may expose internal representation by
    returning IOExceptionList.causeList [org.apache.commons.io
    .IOExceptionList] At IOExceptionList.java:[line 129]
    EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getDirList() may expose internal
    representation by returning AccumulatorPathVisitor.dirList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 179] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.file
    .AccumulatorPathVisitor.getFileList() may expose internal
    representation by returning AccumulatorPathVisitor.fileList
    [org.apache.commons.io.file.AccumulatorPathVisitor] At
    AccumulatorPathVisitor.java:[line 188] EI_EXPOSE_REP
    + Fix SpotBugs error: org.apache.commons.io.input
    .ObservableInputStream.getObservers() may expose internal
    representation by returning ObservableInputStream.observers
    [org.apache.commons.io.input.ObservableInputStream] At
    ObservableInputStream.java:[line 187] EI_EXPOSE_REP
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int) will leave
    the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 202]
    CT_CONSTRUCTOR_THROW
    + Fix SpotBugs error: Exception thrown in class org.apache
    .commons.io.input.UnsynchronizedByteArrayInputStream at new
    org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream(byte[], int, int) will
    leave the constructor. The object under construction remains
    partially initialized and may be vulnerable to Finalizer
    attacks. [org.apache.commons.io.input
    .UnsynchronizedByteArrayInputStream, org.apache.commons.io
    .input.UnsynchronizedByteArrayInputStream] At
    UnsynchronizedByteArrayInputStream.java:[line 223]
    CT_CONSTRUCTOR_THROW
- Upgrade to 2.15.0
  * New features:
    + Add org.apache.commons.io.channels.FileChannels
    + Add RandomAccessFiles#contentEquals(RandomAccessFile,
    RandomAccessFile)
    + Add RandomAccessFiles#reset(RandomAccessFile)
    + Add PathUtilsContentEqualsBenchmark
    + Add org.apache.commons.io.StreamIterator
    + Add MessageDigestInputStream and deprecate
    MessageDigestCalculatingInputStream
  * Fixed Bugs:
    + IO-815: XmlStreamReader encoding match RE is too strict
    + IO-810: Javadoc in FileUtils does not reflect code for thrown
    exceptions
    + IO-812: Javadoc should mention closing Streams based on file
    resources
    + IO-811: In tests, Files.walk() direct and indirect callers
    fail to close the returned Stream
    + IO-811: FileUtils.listFiles(File, String[], boolean) fails to
    close its internal Stream
    + IO-811: FileUtils.iterateFiles(File, String[], boolean) fails
    to close its internal Stream
    + IO-811: StreamIterator fails to close its internal Stream
    + IO-814: Don't throw UncheckedIOException
    + IO-414: Don't write a BOM on every (or any) line
    + IO-814: RandomAccessFileMode.create(Path) provides a better
    NullPointerException message
    + Improve performance of PathUtils.fileContentEquals(Path, Path,
    LinkOption[], OpenOption[]) by about 60%, see
    PathUtilsContentEqualsBenchmark
    + Improve performance of PathUtils.fileContentEquals(Path, Path)
    by about 60%, see PathUtilsContentEqualsBenchmark
    + Improve performance of FileUtils.contentEquals(File, File) by
    about 60%, see PathUtilsContentEqualsBenchmark
    + Remove unused test code
    + [Javadoc] IOUtils#contentEquals does not throw
    NullPointerException
    + Fix CodeQL warnings in UnsynchronizedBufferedInputStream:
    Implicit narrowing conversion in compound assignment
    + MessageDigestCalculatingInputStream
    .MessageDigestMaintainingObserver
    .MessageDigestMaintainingObserver(MessageDigest) now throws a
    NullPointerException if the MessageDigest is null
    + MessageDigestCalculatingInputStream
    .MessageDigestCalculatingInputStream(InputStream,
    MessageDigest) now throws a NullPointerException if the
    MessageDigest is null
    + IO-816: UnsynchronizedBufferedInputStream.read(byte[], int,
    int) does not use buffer</changelog>
  <changelog author="gus.kenion@suse.com" date="1714392000">- Upgrade to 2.16.1
  * Fixes:
    + Reimplement FileSystemUtils using NIO.
    + FileSystemUtils no longer throws IllegalStateException. Fixes
    IO-851.
    + Avoid possible NullPointerException in
    FileUtils.listAccumulate(File, IOFileFilter, IOFileFilter,
    FileVisitOption...).
    + BoundedInputStream.reset() not updating count. Fixes IO-853.
    + ThresholdingOutputStream: a negative threshold should behave
    like a zero threshold and trigger the event on the first
    write #609. Fixes IO-854.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.12 to 1.14.13 #605.
    + Bump org.apache.commons:commons-parent from 67 to 69 #608.
- Update apache-commons-io-build.xml for new version
- Includes changes from 2.16.0
  * Fixes:
    + Fix and re-enable testSkip_RequiredCharsets #518.
    + SymbolicLineFileFilter documentation fixes. Fixes IO-824.
    + CharSequenceInputStream.reset() only works once #520. Fixes
    IO-795.
    + Finish TODO on CharSequenceInputStream #540. Fixes IO-795.
    + Add byte array size validation for methods in EndianUtils
    [#521]. Fixes IO-825.
    + Add missing test case CircularByteBufferTest. Fixes IO-825.
    + Make CharSequenceInputStream.available() more correct in the
    face of multibyte encodings #525. Fixes IO-781.
    + Remove unreachable code in AbstractIOFileFilterTest #526.
    Fixes IO-781.
    + Rationalize and unify checking for existence of files and
    directories #529. Fixes IO-808.
    + Avoid NullPointerException in IOCase.checkEquals(String,
    String) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    CanExecuteFileFilter.accept(Path, BasicFileAttributes) on
    null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanReadFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in CanWriteFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(File) on null input.
    + Avoid NullPointerException in
    DirectoryFileFilter.accept(Path, BasicFileAttributes) on null
    input.
    + Avoid NullPointerException in EmptyFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in EmptyFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in FileFileFilter.accept(File) on
    null input.
    + Avoid NullPointerException in FileFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(File)
    on null input.
    + Avoid NullPointerException in HiddenFileFilter.accept(Path,
    BasicFileAttributes) on null input.
    + Avoid NullPointerException in IOCase.checkIndexOf(String,
    int, String) on null input.
    + Avoid NullPointerException in
    IOCase.checkRegionMatches(String, int, String) on null input.
    + BoundedInputStream.getCount() should not count EOF.
    + Modernize temporary file creation and deletion in
    DeferredFileOutputStreamTest #535.
    + Add PathMatcher to IOFileFilter class Javadoc #536.
    + Fix CharSequenceInputStream coding exception handling #537.
    Fixes IO-781.
    + Deprecate int CountingInputStream#getCount() in favor of long
    CountingInputStream#getByteCount(). Fixes IO-781.
    + Deprecate CountingInputStream.resetCount() in favor of
    resetByteCount(). Fixes IO-828.
    + Deprecate CountingInputStream.getMaxLength() in favor of
    getMaxCount()). Fixes IO-828.
    + NullInputStream breaks InputStream's read method contract.
    Fixes IO-818.
    + Javadoc shouldn't reference 1.x behavior #539.
    + Don't decode and reencode characters in a potentially
    different charset in
    AbstractOrigin.CharSequenceOrigin.getReader(Charset). Fixes
    IO-829.
    + Let subclasses of CountingInputStream.afterRead(int) throw
    IOException.
    + Characterization test for broken symlinks when copying
    directories #547. Fixes IO-807.
    + ClosedInputStream.read(byte[], int, int) does not always
    return -1.
    + ClosedOutputStream.write(byte[], int, int) does not always
    throw IOException.
    + XmlStreamReader can't parse an XML document with a multi-line
    prolog #550.
    + XmlStreamReader can't parse XML an document with an external
    parsed entity prolog.
    + Update FileNameUtils Javadoc #554. Fixes IO-836.
    + Copy symlinks, not the files the symlinks point to #558.
    Fixes IO-807.
    + Pickup apache-rat-plugin version from parent POM.
    + Add test for copying a symlink
    FileUtilsTest#testCopyFile_symLink() #564.
    + Make copyFile copy symbolic links by value rather than
    reference #565.
    + Deprecate CopyUtils 0-argument constructor.
    + Deprecate EndianUtils 0-argument constructor. Fixes IO-843.
    + Deprecate FileSystemUtils 0-argument constructor.
    + Deprecate FilenameUtils 0-argument constructor.
    + Deprecate RandomAccessFiles 0-argument constructor.
    + Clarify and correct EndianUtils and SwappedDataInputStream
    API doc #566.
    + Add characterization test for copying a symlinked directory
    [#570].
    + RandomAccessFileInputStream.builder().get() now throws ISE
    instead of NPE.
    + Test links to targets outside the source directory #571.
    Fixes IO-845.
    + Focus Javadoc on current version rather than past versions
    [#573], #574.
    + "Self-suppression not permitted" while using BrokenOutput and
    BrokenInput streams with try-with-resources. Fixes IO-469.
    + Handle zero and negative thresholds #587. Fixes IO-405.
    + Deprecate CountingInputStream in favor of BoundedInputStream.
    + PathUtils.setPosixPermissions(...) only sets permissions if
    needed.
    + PathUtils.setReadOnly(...) only sets permissions if needed.
    + PathUtils.deleteFile(..., DeleteOption...) only sets
    permissions if needed.
    + CleaningPathVisitor only sets permissions if needed.
    + DeletingPathVisitor only sets permissions if needed.
  * New features:
    + Add and use PathUtils.getFileName(Path, Function&lt;Path, R&gt;).
    + Add and use PathUtils.getFileNameString().
    + Make public Erase.rethrow(Throwable).
    + Add BrokenInputStream.BrokenInputStream(Throwable). Fixes
    IO-826.
    + Add BrokenReader.BrokenReader(Throwable). Fixes IO-826.
    + Add BrokenOutputStream.BrokenOutputStream(Throwable). Fixes
    IO-826.
    + Add BrokenWriter.BrokenWriter(Throwable). Fixes IO-826.
    + Add BoundedInputStream.getRemaining().
    + Add FileTimes.toNtfsTime(long).
    + Add FileTimes.fromUnixTime(long).
    + Add FileTimes.isUnixTime(FileTime).
    + Add FileTimes.isUnixTime(long).
    + Add FileTimes.toUnixTime(FileTime).
    + Add BrokenInputStream.Builder.
    + Add PathUtils.getExtension(Path).
    + Add PathUtils.getBaseName(Path).
    + Add ThrottledInputStream.
    + Add IORunnable.noop().
    + Add ChecksumInputStream and test #548.
    + Add AbstractStreamBuilder.getReader().
    + Add Maven property project.build.outputTimestamp for build
    reproducibility.
    + Add ProxyInputStream.unwrap().
    + Add a running count and builder to BoundedInputStream.
  * Updates:
    + Bump commons.bytebuddy.version from 1.14.10 to 1.14.12 #534,
    [#592].
    + Bump org.apache.commons:commons-parent from 65 to 67.
    + Bump commons-codec:commons-codec from 1.16.0 to 1.16.1 #583.
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.1.1 to 3.2.0
    [#593].</changelog>
  <changelog author="fstrba@suse.com" date="1728043200">- Upgrade to 2.17.0
  * New features:
    + Add IOIterator.adapt(Iterable)
    + Add getInputStream() for 'https' and 'http' in URIOrigin
    [#630]. Fixes IO-831
    + Add IOSupplier.getUnchecked()
    + Add CloseShieldInputStream.systemIn(InputStream)
    + Add NullInputStream.init()
    + Add AbstractInputStream and refactor duplicate code
    + Add UnsynchronizedReader
    + Add UnsynchronizedBufferedReader
  * Fixes:
    + FileUtilsWaitForTest does not test anything useful.
    Fixes IO-858.
    + Add missing unit tests
    + FileUtils.lastModifiedFileTime(File) calls
    Objects.requireNonNull() on the wrong object
    + PathUtils.deleteOnExit(Path) calls Objects.requireNonNull()
    on the wrong object
    + Deprecate LineIterator.nextLine() in favor of next()
    + Fix PMD UnnecessaryFullyQualifiedName
    + Add test for CircularByteBuffer clear() #620
    + PathUtils.isPosix(Path, LinkOption...) should return false on
    null input
    + AutoCloseInputStream(InputStream) uses
    ClosedInputStream.INSTANCE when its input is null
    + Avoid NullPointerException in ProxyInputStream.available()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.markSupported()
    when the underlying input stream is null
    + Avoid NullPointerException in ProxyInputStream.mark(int) when
    the underlying input stream is null
    + BufferedFileChannelInputStream.available() returns 0 before
    any reads
    + BufferedFileChannelInputStream.available() should return 0
    instead of -1 at the end of the stream
    + BufferedFileChannelInputStream.available() should return 0
    when the stream is closed instead of throwing an exception
    + CharSequenceInputStream.available() should return 0 after the
    stream is closed
    + BoundedInputStream.available() should return 0 when the
    stream is closed
    + CircularInputStream.available() should return 0 when the
    stream is closed
    + InfiniteCircularInputStream.available() should return 0 when
    the stream is closed
    + ChecksumInputStream(InputStream, Checksum, long, long) should
    fail-fast on null Checksum input
    + Deprecate NullInputStream.INSTANCE in favor of constructors
    + NullInputStream.available() should return 0 after the stream
    is closed
    + MemoryMappedFileInputStream.available() should return 0 after
    the stream is closed
    + RandomAccessFileInputStream.available() should return 0 after
    the stream is closed
    + ReaderInputStream.available() should return 0 after the
    stream is closed
    + AutoCloseInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + BoundedInputStream does not call handleIOException() on
    close() when the proxied stream throws an IOException
    + NullInputStream.read(*) should throw IOException when it is
    closed
    + NullInputStream.read(byte[]) should return 0 when the input
    byte array in length 0
    + NullInputStream.read(byte[], int, int) should return 0 when
    the input byte array in length 0 or requested length is 0
    + MarkShieldInputStream.read(*) should throw IOException when
    it is closed
    + Replace deprecated constant FileFileFilter.FILE in Javadoc
    [#657]
    + Pick up exec-maven-plugin version from parent POM
  * Updates:
    + Bump tests commons.bytebuddy.version from 1.14.13 to 1.15.1
    [#615], #621, #631, #635, #642, #658, #663, #665
    + Bump tests commons-codec:commons-codec from 1.16.1 to 1.17.1
    [#644]
    + Bump org.codehaus.mojo:exec-maven-plugin from 3.2.0 to 3.4.1
    [#632], #652, #659
    + Bump org.apache.commons:commons-parent from 69 to 74 #628,
    [#637], #649, #661, #664
    + Bump org.apache.commons:commons-lang3 from 3.14.0 to 3.17.0
    [#645], #653, #666</changelog>
  <changelog author="gus.kenion@suse.com" date="1737720000">- Upgrade to 2.18.0
  * New features
    + Add @FunctionalInterface to ClassNameMatcher.
    + Add ValidatingObjectInputStream.Builder and
    ValidatingObjectInputStream.builder().
    + Add a "Safe Deserialization" section to the User Guide for
    the site.
    + Add IORandomAccessFile.
    + Add RandomAccessFileMode.io(String).
    + Add FileAlterationObserver.Builder() and deprecate most
    constructors.
    + Add IOUtils.readLines(CharSequence).
    + Add ValidatingObjectInputStream.ObjectStreamClassPredicate to
    allow configuration reuse.
    + Add RandomAccessFileMode.accept(Path,
    IOConsumer&lt;RandomAccessFile&gt;).
    + Add RandomAccessFileMode.apply(Path,
    IOFunction&lt;RandomAccessFile&gt;, T).
    + Add IOIntConsumer.
    + Add ProxyInputStream.AbstractBuilder. Supports setting a
    consumer for ProxyInputStream.afterRead(int).
    + Add support to AutoCloseInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to BOMInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to BoundedInputStream for setting a consumer for
    BoundedInputStream.onMaxLength(long, long).
    + Add support to ChecksumInputStream for setting a consumer for
    ProxyInputStream.afterRead(int).
    + Add support to ThrottledInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to ObservableInputStream for setting a consumer
    for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestCalculatingInputStream for
    setting a consumer for ProxyInputStream.afterRead(int).
    + Add support to MessageDigestInputStream for setting a
    consumer for ProxyInputStream.afterRead(int).
  * Fixed Bugs
    + Clean ups in unit tests.
    + Fix some Javadoc issues.
    + RandomAccessFileMode.toString() is more helpful for debugging
    when it inherits from Enum.
    + Fix implicit narrowing conversion in compound assignment in
    UnsynchronizedBufferedReader.skip(long).
    + IO-860:  Missing reserved file names in FileSystem.WINDOWS
    (superscript digits for COM and LPT).
    + IO-856:  FileUtils.listFiles(final File, String[], boolean)
    can throw NoSuchFileException #697, #699.
    + IO-859:  FileUtils.forceDelete on non-existent file on Windows
    throws IOException rather than FileNotFoundException.
    + Use Unicode escapes for superscript characters. #701.
    + IO-863:  Recent incompatible change to FileUtils.listFiles re
    extensions, see also IO-856.
    + IO-857:  Javadoc: Update details for PathUtils "clean"
    behavior.
  * Changes
    + Bump org.apache.commons:commons-parent from 74 to 78 #670,
    [#676], #679, #688.
    + Bump commons.bytebuddy.version from 1.15.1 to 1.15.10 #672,
    [#673], #685, #686, #694, #696, #698.
    + Update AbstractStreamBuilder getters from protected to
    public.</changelog>
</package>
<package pkgid="6dd13afe51365a7459f96b4467799640dac178a9422b74f05d07e2e0d6582211" name="apache-commons-lang3" arch="noarch">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="8aa161da5fdff52dd1d611172d69784643d6c5b32235d3c3d258a3b43c95ef4f" name="apache-commons-lang3" arch="src">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="f1b6d7ce7c447daf6dc3c83ea7a0d7cc4410ecb5f7e59a7ade4221b4c35b4b17" name="apache-commons-lang3-javadoc" arch="noarch">
  <version epoch="0" ver="3.16.0" rel="150200.3.9.2"/>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Initial release (version 3.4)</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local</changelog>
  <changelog author="fstrba@suse.com" date="1505390400">- Specify java target and source level 1.6
- Force building with jdk &lt; 1.9, since jdk9's javadoc chocks on one
  class file (internal error)</changelog>
  <changelog author="fstrba@suse.com" date="1507550400">- Modified patch:
  * commons-lang3-3.4-javadoc.patch
    + Fix build with jdk9
- Allow building with jdk9 too
- Run fdupes on javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1525262400">- Format with spec-cleaner</changelog>
  <changelog author="fstrba@suse.com" date="1540209600">- Build commons-lang3-3.8.1 using modified build.xml and
  default.properties from 3.4.
- Removed patch:
  * commons-lang3-3.4-javadoc.patch
  - integrated in the build.xml
- Use source and target version 1.7, since the code contains
  diamond operator.</changelog>
  <changelog author="fstrba@suse.com" date="1549281600">- Clean-up the spec file and install less jar symlinks</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="fstrba@suse.com" date="1613476800">- Add OSGi manifest</changelog>
  <changelog author="rpm@fthiessen.de" date="1619179200">- Fixed SPEC file: Replaced broken URL
- Update to 3.9
  * Requires jdk &gt;= 1.8
  * Fixed issues with java 12
  * Add more SystemUtils.IS_JAVA_XX variants
  * Adding the Functions class
  * Add @FunctionalInterface to ThreadPredicate and ThreadGroupPredicate
  * Add isEmpty method to ObjectUtils
  * null-safe StringUtils.valueOf(char[]) to delegate to
    String.valueOf(char[]).
  * Add API org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost(JavaVersion)
  * Consolidate the StringUtils equals and equalsIgnoreCase</changelog>
  <changelog author="david.anes@suse.com" date="1640347200">- Updated download URL.
- Update to 3.12.0:
  - New features:
  * Add BooleanUtils.booleanValues().
  * Add BooleanUtils.primitiveValues().
  * Add StringUtils.containsAnyIgnoreCase(CharSequence, CharSequence...).
  * Add StopWatch.getStopTime().
  * More test coverage for CharSequenceUtils.
  * Add fluent-style ArraySorter.
  * Add and use LocaleUtils.toLocale(Locale) to avoid NPEs.
  * Add FailableShortSupplier, handy for JDBC APIs.
  * Add JavaVersion.JAVA_17.
  * Add missing boolean[] join method.
  * Add StringUtils.substringBefore(String, int).
  * Add Range.INTEGER.
  * Add DurationUtils.
  * Introduce the use of @Nonnull, and @Nullable, and the Objects class as a helper tool.
  * Add and use true and false String constants.
  * Add and use ObjectUtils.requireNonEmpty().
  - Fixed Bugs:
  * Correct implementation of RandomUtils.nextLong(long, long).
  * Restore handling of collections for non-JSON ToStringStyle.
  * ContextedException Javadoc add missing semicolon.
  * Resolve JUnit pioneer transitive dependencies using JUnit BOM.
  * NumberUtilsTest - incorrect types in min/max tests.
  * Improve StringUtils.stripAccents conversion of remaining accents.
  * StringUtils.countMatches - clarify Javadoc.
  * Remove redundant argument from substring call.
  * BigDecimal is created when you pass it the min and max values.
  * ArrayUtils.contains() and indexOf() fail to handle Double.NaN.
  * ArrayUtils contains() and indexOf() fail to handle Float.NaN.
  * Fix potential NPE in TypeUtils.isAssignable(Type, ParameterizedType, Map, Type&gt;).
  * TypeUtils.isAssignable returns wrong result for GenericArrayType and ParameterizedType.
  * testGetAllFields and testGetFieldsWithAnnotation sometimes fail.
  * Fix Javadoc for SystemUtils.isJavaVersionAtMost().
  * Fix StringUtils.unwrap throws StringIndexOutOfBoundsException.
  * Fix formatting of isAnyBlank() and isAnyEmpty().
  * TypeUtils. containsTypeVariables does not support GenericArrayType.
  * Javadoc of some methods incorrectly refers to another method.
  * Refine StringUtils.lastIndexOfIgnoreCase.
  * Refine StringUtils.abbreviate.
  * Refine StringUtils.isNumericSpace.
  * Refine StringUtils.deleteWhitespace.
  * Correction in Javadoc of some methods.
  * Javadoc for RandomStringUtils.random() letters, numbers parameters is wrong.
  * Correct markup in Javadoc for unbalanced braces.
  * MethodUtils.invokeMethod NullPointerException in case of null in args list.
  * Fix 2 digit week year formatting.
  * Fix broken Javadoc links to commons-text.
  * Add and use ThreadUtils.sleep(Duration).
  * Add and use ThreadUtils.join(Thread, Duration).
  * Add ObjectUtils.wait(Duration).
  - Changes:
  * ArrayUtils.toPrimitive(Object) does not support boolean and other types.
  * Enable Dependabot.
  * Bump junit-jupiter from 5.6.2 to 5.7.0.
  * Bump spotbugs from 4.1.2 to 4.2.1.
  * Bump spotbugs-maven-plugin from 4.0.0 to 4.2.0.
  * Bump biz.aQute.bndlib from 5.1.1 to 5.3.0.
  * Bump junit-pioneer from 0.6.0 to 1.1.0.
  * Bump checkstyle from 8.34 to 8.40.
  * Bump actions/checkout from v2.3.1 to v2.3.4.
  * Bump actions/setup-java from v1.4.0 to v1.4.2.
  * Update commons.jacoco.version 0.8.5 to 0.8.6 (Fixes Java 15 builds).
  * Update maven-surefire-plugin 2.22.2 -&gt; 3.0.0-M5.
  * Bump maven-pmd-plugin from 3.13.0 to 3.14.0.
  * Bump jmh.version from 1.21 to 1.27.
  * Update commons.japicmp.version 0.14.3 -&gt; 0.15.2.
  * Processor.java: check enum equality with == instead of .equals() method.
  * Bump junit-pioneer from 1.1.0 to 1.3.0.
  * Bump maven-checkstyle-plugin from 3.1.1 to 3.1.2.
  * Bump actions/cache from v2 to v2.1.4.
  * Bump junit-bom from 5.7.0 to 5.7.1.
  * Minor Improvements.
  * Minor Improvement: Add final variable.try to make the code read-only.
  * Minor Improvement: Remove redundant initializer.
  * Use own validator ObjectUtils.anyNull to check null String input.
- From 3.11 Update:
  - New features:
  * Add ArrayUtils.isSameLength() to compare more array types.
  * Added the Locks class as a convenient possibility to deal with locked objects.
  * Add to Functions: FailableBooleanSupplier, FailableIntSupplier, FailableLongSupplier, FailableDoubleSupplier, and so on.
  * Add ArrayUtils.get(T[], index, T) to provide an out-of-bounds default value.
  * Add JavaVersion enum constants for Java 14 and 15.
  * Add JavaVersion enum constants for Java 16.
  * Use Java 8 lambdas and Map operations.
  * Change removeLastFieldSeparator to use endsWith.
  * Change a Pattern to a static final field, for not letting it compile each time the function invoked.
  * Add ImmutablePair factory methods left() and right().
  * Add ObjectUtils.toString(Object, Supplier&lt;String&gt;).
  * Add org.apache.commons.lang3.StringUtils.substringAfter(String, int).
  * Add org.apache.commons.lang3.StringUtils.substringAfterLast(String, int).
  - Fixed Bugs:
  * Fix Javadoc for StringUtils.appendIfMissingIgnoreCase().
  * Refine Javadoc.
  * Fix typos
  * Ignored exception `ignored`, should not be called so.
  * StringUtils.replaceEachRepeatedly gives IllegalStateException.
  * [JSON string for maps] ToStringBuilder.reflectionToString doesnt render nested maps correctly.
  * Correct Javadocs of methods that use Validate.notNull() and replace some uses of Validate.isTrue() with Validate.notNull().
  * Add allNull() and anyNull() methods to ObjectUtils.
  - Changes:
  * Refine test output for FastDateParserTest
  * CharSequenceUtils.lastIndexOf : remake it
  * remove encoding and docEncoding and use inherited values from commons-parent
  * Simplify null checks in Pair.hashCode() using Objects.hashCode().
  * Simplify null checks in Triple.hashCode() using Objects.hashCode().
  * Simplify some if statements in StringUtils.
  * Simplify a null check in the private replaceEach() method of StringUtils.
  * Replace some usages of the ternary operator with calls to Math.max() and Math.min().
  * (Javadoc) Fix return tag for throwableOf*() methods.
  * CharSequenceUtils.regionMatches is wrong dealing with Georgian.
  * Optimize ArrayUtils::isArrayIndexValid method.
  * Use List.sort instead of Collection.sort.
  * Use StandardCharsets.UTF_8.
  * Use Collections.singletonList insteadof Arrays.asList when there be only one element.
  * Change array style from `int a[]` to `int[] a`.
  * Change from addAll to constructors for some List.
  * Simplify if as some conditions are covered by others.
  * Fixed Javadocs for setTestRecursive().
  * ToStringBuilder.reflectionToString - Wrong JSON format when object has a List of Enum.
  * Make org.apache.commons.lang3.CharSequenceUtils.toCharArray(CharSequence) public.
  * org.apache.commons:commons-parent 50 -&gt; 51.
  * org.junit-pioneer:junit-pioneer 0.5.4 -&gt; 0.6.0.
  * org.junit.jupiter:junit-jupiter 5.6.0 -&gt; 5.6.2.
  * com.github.spotbugs:spotbugs 4.0.0 -&gt; 4.0.6.
  * com.puppycrawl.tools:checkstyle 8.29 -&gt; 8.34.
  * commons.surefire.version 3.0.0-M4 -&gt; 3.0.0-M5..
- From 3.10 Update:
  - New features:
  * Add ExceptionUtils.throwableOfType(Throwable, Class) and friends.
  * Add EMPTY_ARRAY constants to classes in org.apache.commons.lang3.tuple.
  * Add null-safe StringUtils APIs to wrap String#getBytes([Charset|String]).
  * Add zero arg constructor for org.apache.commons.lang3.NotImplementedException.
  * Add ArrayUtils.addFirst() methods.
  * Add Range.fit(T) to fit a value into a range.
  * Added Functions.as*, and tests thereof, as suggested by Peter Verhas
  * Add getters for lhs and rhs objects in DiffResult.
  * Generify builder classes Diffable, DiffBuilder, and DiffResult.
  * Add ClassLoaderUtils with toString() implementations.
  * Add null-safe APIs as StringUtils.toRootLowerCase(String) and StringUtils.toRootUpperCase(String).
  * Add org.apache.commons.lang3.time.Calendars.
  * Add EnumUtils getEnum() methods with default values.
  * Added indexesOf methods and simplified removeAllOccurences.
  * Add support of lambda value evaluation for defaulting methods.
  * Add factory methods to Pair classes with Map.Entry input.
  * Add StopWatch convenience APIs to format times and create a simple instance.
  * Allow a StopWatch to carry an optional message.
  * Add ComparableUtils.
  * Add org.apache.commons.lang3.SystemUtils.getUserName().
  * Add ObjectToStringComparator.
  * Add org.apache.commons.lang3.arch.Processor.Arch.getLabel().
  * Add IS_JAVA_14 and IS_JAVA_15 to org.apache.commons.lang3.SystemUtils.
  * ObjectUtils: Get first non-null supplier value.
  * Added the Streams class, and Functions.stream() as an accessor thereof.
  - Fixed Bugs:
  * Make test more stable by wrapping assertions in hashset.
  * Generate Javadoc jar on build.
  * Trivial: year of release for 3.9 says 2018, should be 2019.
  * Use synchronize on a set created with Collections.synchronizedSet before iterating.
  * StringUtils.unwrap incorrect throw StringIndexOutOfBoundsException.
  * StringIndexOutOfBoundsException in StringUtils.replaceIgnoreCase.
  * StringUtils.removeIgnoreCase("?a", "a") throws IndexOutOfBoundsException.
  * Corrected usage examples in Javadocs.
  * StringUtils abbreviate returns String of length greater than maxWidth.
  * Test may fail due to a different order of fields returned by reflection api.
  * Sort fields in ReflectionToStringBuilder for deterministic order.
  * MethodUtils will throw a NPE if invokeMethod() is called for a var-args method.
  * MethodUtils.getAnnotation() with searchSupers = true does not work if super is generic.
  - Changes:
  * Remove redundant if statements in join methods.
  * commons.japicmp.version 0.13.1 -&gt; 0.14.1.
  * junit-jupiter 5.5.0 -&gt; 5.5.1.
  * junit-jupiter 5.5.1 -&gt; 5.5.2.
  * Improve Javadoc based on the discussion of the GitHub PR.
  * maven-checkstyle-plugin 3.0.0 -&gt; 3.1.0.
  * Update documentation related to the issue LANG-696.
  * AnnotationUtils little cleanup.
  * Update test dependency: org.easymock:easymock 4.0.2 -&gt; 4.1.
  * Update test dependency: org.hamcrest:hamcrest 2.1 -&gt; 2.2.
  * Update test dependency: org.junit-pioneer:junit-pioneer 0.3.0 -&gt; 0.4.2.
  * Update build dependency: com.puppycrawl.tools:checkstyle 8.18 -&gt; 8.27.
  * Update POM parent: org.apache.commons:commons-parent 48 -&gt; 50.
  * BooleanUtils Javadoc.
  * Functions Javadoc.
  * org.easymock:easymock 4.1 -&gt; 4.2.
  * org.junit-pioneer:junit-pioneer 0.4.2 -&gt; 0.5.4.
  * org.junit.jupiter:junit-jupiter 5.5.2 -&gt; 5.6.0.
  * Use Javadoc {@code} instead of pre tags.
  * ExceptionUtilsTest to 100%.
  * Reuse own code in Functions.java.
  * Avoid unnecessary allocation in StringUtils.wrapIfMissing.
  * Internally use Validate.notNull(foo, ...) instead of Validate.isTrue(foo != null, ...).
  * Add 1 and 0 in toBooleanObject(final String str).
  * Remove an redundant argument check in NumberUtils.
  * Deprecate org.apache.commons.lang3.ArrayUtils.removeAllOccurences(*) for org.apache.commons.lang3.ArrayUtils.removeAllOccurrences(*).</changelog>
  <changelog author="david.anes@suse.com" date="1640779200">- Fix component version in default.properties to 3.12</changelog>
  <changelog author="pmonreal@suse.com" date="1640779201">- Remove the junit bom dependency for now as it breaks the build of
  other packages like log4j.
  * Add apache-commons-lang3-junit-bom.patch</changelog>
  <changelog author="fstrba@suse.com" date="1693396800">- Break cycle with the new bcel
- Removed patch:
  * apache-commons-lang3-junit-bom.patch
    + not needed since we install the pom file using the new
    %%mvn_install_pom macro which sanitizes the pom file to the
    bare runtime dependencies.</changelog>
  <changelog author="fstrba@suse.com" date="1715688000">- Update to 3.14.0:
  * New features:
    + Add Functions#function(Function).
    + Add FailableFunction#function(FailableFunction).
    + Add CalendarUtils.getInstance().
    + Add syntax for optional tokens to DurationFormatUtils.
    + Add ArrayFill.
    + Add FastDateParser.TimeZoneStrategy.TzInfo.toString().
    + Add LocaleUtils.isLanguageUndetermined(Locale).
    + Add ObjectUtils.toString(Supplier&lt;Object&gt;, Supplier&lt;String&gt;).
    + Add LazyInitializer.isInitialized().
    + Add ConcurrentInitializer#isInitialized() #1120.
    + Add Streams.failableStream(T...).
    + Add FailableSupplier.nul().
    + Add Suppliers.nul().
    + Add ExceptionUtils.throwUnchecked(T) where T extends
    Throwable, and deprecate Object version.
    + Add ExceptionUtils.rethrowRuntimeException(T), and deprecate
    rethrow(T).
    + ConcurrentInitializer implementations can now be instantiated
    and configured with allocation and release lambdas.
    Fixes LANG-1716.
    + Add support for RISC-V in ArchUtils #1128. Fixes LANG-1717.
  * Fixed bugs:
    + Rename variable names from 'clss' to 'clazz'.
    + [Javadoc] ComparableUtils'c1' to 'comparable1', 'c2' to
    'comparable2'
    + [Javadoc] Remove 2.1 specific comment #1091.
    + [Javadoc] Fix Incorrect Description in Processor isAarch64()
    [#1093]. Fixes LANG-1704.
    + [Javadoc] Point to right getShortClassName flavor in Javadoc
    for relevant notes #1097.
    + Improve performance of StringUtils.isMixedCase().
    + ThreadUtils find methods should not return null items. Fixes
    LANG-1706.
    + ReflectionToStringBuilder changes in version 3.13.0 has broken
    the logic for overriding classes. Fixes LANG-1710.
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(ClassLoader).
    + Return "null" instead of NPE in
    ClassLoaderUtils.toString(URLClassLoader).
    + Return ToStringStyle.nullText instead of NPE for
    ReflectionToStringBuilder.toString().
    + Fix ThresholdCircuitBreaker#checkState().
    + Use ConcurrentInitializer implementations without subclassing.
    + Update critical value for chi-square test.
    + Fix Javadoc syntax errors #1129.
- From 3.13.0 update
  * New features:
    + Add GitHub coverage.yml.
    + Add EnumUtils.getEnumSystemProperty(...).
    + Add TriConsumer.
    + Add and use EnumUtils.getFirstEnumIgnoreCase(Class, String,
    Function, E).
    + Add and use Suppliers.
    + Add and use ArrayUtils.getComponentType(T[]).
    + Add and use ClassUtils.getComponentType(Class&gt;T[]&gt;).
    + Add and use ObjectUtils.getClass(T).
    + Add and use ArrayUtils.newInstance(Class&gt;T&gt;, int).
    + Add and use null-safe Streams.of(T...).
    + Add ClassUtils.comparator().
    + Add and use ThreadUtils.sleepQuietly(Duration).
    + Add and use ArrayUtils.setAll(T[], IntFunction).
    + Add and use ArrayUtils.setAll(T[], Supplier).
    + Add BooleanConsumer.
    + Add IntToCharFunction.
    + Add IntStreams.
    + Add UncheckedFuture.
    + Add UncheckedException.
    + Add UncheckedExecutionException.
    + Add UncheckedTimeoutException.
    + Add UncheckedInterruptedException.
    + Add TimeZones.GMT.
    + Add ObjectUtils.identityHashCodeHex(Object).
    + Add ObjectUtils.hashCodeHex(Object).
    + Add StringUtils.removeStart(String, char).
    + Add null-safe ObjectUtils.isArray(). Fixes LANG-1659.
    + Add ComparableUtils.max(A, A) and ComparableUtils.min(A, A).
    + Add UncheckedReflectiveOperationException.
    + Add and use ClassUtils.isPublic(Class).
    + Add UncheckedIllegalAccessException.
    + Add MethodInvokers.
    + Add Streams.nullSafeStream(Collection).
    + Add Streams.toStream(Collection).
    + Add Streams.failableStream(Collection) and deprecate misnamed
    stream(Collection).
    + Add Streams.failableStream(Stream) and deprecate misnamed
    stream(Stream).
    + Add EnumUtils.getEnumMap(Class, Function).
    + Add FluentBitSet.
    + Add Streams.instancesOf(Class, Collection).
    + Add ImmutablePair.ofNonNull(L, R).
    + Add ImmutableTriple.ofNonNull(L, M, R).
    + Add MutablePair.ofNonNull(L, R).
    + Add MutableTriple.ofNonNull(L, M, R).
    + Add Pair.ofNonNull(L, R).
    + Add Triple.ofNonNull(L, M, R).
    + Add ArrayUtils.containsAny(Object[], Object...).
    + Add Processor.Type.AARCH_64.
    + Add Processor.isAarch64().
    + Update ArchUtils.getProcessor(String) for "aarch64".
    + Add JavaVersion.JAVA_18.
    + Add JavaVersion.JAVA_19.
    + Add JavaVersion.JAVA_20.
    + Add JavaVersion.JAVA_21.
    + Add TimeZones.toTimeZone(TimeZone).
    + Add FutureTasks.
    + Add Memoizer(Function) and Memoizer(Function, boolean).
    + Add Consumers.
    + Add github/codeql-action.
    + Add coverage.yml.
    + Add DurationUtils.since(Temporal).
    + Add DurationUtils.of(FailableConsumer|FailableRunnbale).
    + Add ExceptionUtils.forEach(Throwable, Consumer&lt;Throwable&gt;).
    + Add ExceptionUtils.stream(Throwable).
    + Add ExceptionUtils.getRootCauseStackTraceList(Throwable).
    + Add SystemUtils.IS_OS_WINDOWS_11.
    + Add SystemUtils.IS_JAVA_16.
    + Add SystemUtils.IS_JAVA_17.
    + Add SystemUtils.IS_JAVA_18.
    + Add SystemUtils.IS_JAVA_19.
    + Add SystemUtils.IS_JAVA_20.
    + Add SystemUtils.IS_JAVA_21.
    + Add ArrayUtils.oneHot(). Fixes LANG-1627.
    + Let ReflectionToStringBuilder only reflect given field names.
    Fixes LANG-1662.
    + Add Streams.of(Enumeration&lt;E&gt;).
    + Add Streams.of(Iterable&lt;E&gt;).
    + Add Streams.of(Iterator&lt;E&gt;).
    + Simple support for Optional in ObjectUtils#isEmpty(). Fixes
    LANG-1689.
    + Add Processor.Type.getLabel().
    + Add Processor.toString().
    + Add HashCodeBuilder.equals(Object).
    + Add BooleanUtils.values() and forEach().
    + Add ClassPathUtils.packageToPath(String) and pathToPackage(String)
    + Add CalendarUtils#getDayOfYear()
    + Add NumberRange, DoubleRange, IntegerRange, LongRange.
    + Add missing exception javadoc/tests for some null arguments.
    + Add ClassLoaderUtils.getSystemURLs() and getThreadURLs().
    + Add RegExUtils.dotAll() and dotAllMatcher().
    + Add Pair.accept(FailableBiConsumer).
    + Add Pair.apply(FailableBiFunction).
    + Add ReflectionDiffBuilder.setExcludeFieldNames(...) and
    DiffExclude a... Fixes LANG-1677.
    + Add and ExceptionUtils.isChecked() and isUnchecked(). Fixes
    LANG-1647.
    + Add and use ExceptionUtils.throwUnchecked(throwable).
    + Add LockingVisitors.create(O, ReadWriteLock).
  * Fixed bugs:
    + NumberUtils.createNumber() to recognize hex integers prefixed
    with +. Fixes LANG-1645.
    + NumberUtils.createNumber() to return requested floating point
    type for zero. Fixes LANG-1646.
    + DMI: Random object created and used only once
    (DMI_RANDOM_USED_ONLY_ONCE); Better multi-threaded behavior.
    + Redundant Collection operation. Use
    Collections.emptyIterator(). Fixes LANG-1646.
    + Make Streams.stream(Collection) null-safe.
    + Allow tests to access java.util classes such as ArrayList in
    Java 16. Fixes LANG-1667.
    + OpenJDK 16 Day Period Parsing. Fixes LANG-1669.
    + Update documentation to list correct exception for null array
    parameters. Fixes LANG-1663.
    + Fixing reversed Javadoc descriptions in StopWatch.
    + Fix typos in JavaDoc. Fixes LANG-1670.
    + Simplify assertions with equivalent but more simple..
    + Avoid multiple equivalent occurrences of the same expression.
    + Remove redundant initializers.
    + Fix ObjectUtils Javadocs.
    + Make Range constructors more generic. Fixes LANG-1674.
    + Use final and Remove redundant String.
    + Use Set instead of List for checking the contains() method.
    + Javadoc for StringUtils.substringBefore(String str,
    int separator) doesn't mention that the separator is an int.
    + Fix NullPointerException in ThreadUtils.getSystemThreadGroup()
    when the current thread is stopped.
    + ArrayUtils.toPrimitive(Boolean...) null array elements map to
    false, like Boolean.parseBoolean(null) and its callers return
    false.
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows.
    + Deprecate Validate#notNull(Object) in favor of using
    Objects#requireNonNull(Object, String).
    + Use TimeZone from calendar in DateFormatUtils. Fixes
    LANG-1462.
    + Updating javadoc for NullPointerException when
    Validate.notNull() is called.
    + Fixing and adding DateUtils exception Javadocs.
    + Improve performance of StringUtils.unwrap(String, String).
    Fixes LANG-1679.
    + Improve performance of StringUtils.join for primitives. Fixes
    LANG-1675.
    + Fixed NPE getting Stack Trace if Throwable is null. Fixes
    LANG-1675.
    + Make Validate.isAssignableFrom() check null inputs.
    + Fix Javadoc for Validate.isAssignableFrom().
    + Make final mappingFunction variable.
    + Remove unnecessary variable creations.
    + Minor changes.
    + FastDateFormat does not support the 'L'-Pattern from
    SimpleDateFormat. Fixes LANG-1680.
    + Increase test coverage of ComparableUtils from 71% to 100%.
    + Increase method test coverage of
    MultilineRecursiveToStringStyle.
    + Fix unstable coverage of CharSequenceUtils tests noticed
    during merge of PRs 898 and 899.
    + Rewrite Conversion.binaryBeMsb0ToHexDigit to invert logic of
    binaryToHexDigit.
    + Allow extension of previously final classes ImmutablePair and
    ImmutableTriple.
    + Update ClassUtils Javadoc with some missing throws NPE.
    + Javadoc: StringUtils.repeat("", "x", 3) = "xx";.
    + StringUtils.join(Iterable, String) should only return null
    when the Iterable is null.
    + Add tests to increase coverage.
    + Extends Object clauses are redundant.
    + Simplify conditional expression..
    + Fix some Javadoc comments.
    + Deprecate getNanosOfMiili() method with typo and create proper
    getNanosOfMilli().
    + Deprecate ThreadUtils code that defines custom function
    interfaces in favor of stock java.util.function.Predicate
    usage.
    + Fix links in Javadoc and documentation.
    + Deprecate RandomUtils in favor of Apache Commons RNG
    UniformRandomProvider. Fixes LANG-1604.
    + Added docs regarding week year support. Fixes LANG-1638.
    + ClassUtils.getShortCanonicalName doesn't use the
    canonicalName. Fixes LANG-1691.
    + Validate: Get error messages without using String.format when
    varargs is empty.
    + Simplify expression (length is never &lt; 0).
    + Fix simple broken javadoc..
    + Fix typo.
    + Use Objects.requireNonNull() directly.
    + MethodUtils.getMatchingMethod() fails with "Found multiple
    candidates". Fixes LANG-1694.
    + Construct ArrayList with better default size. Fixes LANG-1643.
    + ThreadUtilsTest#testThreadGroups will test failed when using
    Junit5 parallel test.
    + Swap the order of assertion args (first excepted then actual).
    + Fix the comment of Failable, redundant "-".
    + Fix the comment of ComparableUtils, using "smallest", not
    "largest".
    + AnnotationUtilsTest and FormattableUtilsTest Only use static
    imports to import assert methods in tests.
    + [LANG-1681] Fix some FieldUtils Javadocs.
    + Remove unnecessary statement in DurationFormatUtils.
    + Corrected value of SystemUtils.JAVA_VENDOR. Fixes LANG-1699.
    + [StepSecurity] ci: Harden GitHub Actions.
    + Update Javadoc for the insert methods in ArrayUtils.
    + Deprecate ExceptionUtils.ExceptionUtils().
    + TypeUtils.getRawType() throws a NullPointerException on
    Wildcard GenericArrayType. Fixes LANG-1697.
    + Throw IllegalArgumentException instead of InternalError in the
    builder package.
    + Avoid NPE in MutableObject#equals() for null content.
    + SystemUtils fix and updates related to macOS.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Update to 3.16.0:
  * New features:
    + Add StopWatch.getSplitDuration() and deprecate
    getSplitTime().
    + Add StopWatch.getStartInstant() and deprecate getStartTime().
    + Add StopWatch.getStopInstant() and deprecate getStopTime().
    + Add StopWatch.getDuration() and deprecate getTime().
    + Add Javadoc links from StopWatch to DurationUtils #1249.
    + Add LangCollectors.collect(Collector, T...).
    + Add RandomStringUtils.secure().
    + Add RandomStringUtils.insecure().
  * Fixed bugs:
    + Reimplement StopWatch internals to use java.time.
    + RandomStringUtils.random() with a negative character index
    should throw IllegalArgumentException. Fixes LANG-1745.
    + LocaleUtils.toLocale(String) cannot parse four segments.
    Fixes LANG-1741.
    + Use fewer intermediary strings in
    DefaultExceptionContext.getFormattedExceptionMessage(String).
    + Fix Javadoc in StringUtils.splitPreserveAllTokens() #1251.
    + Deprecate ArraySort constructor for removal.
    + Deprecate CharEncoding constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate Conversion constructor for removal.
    + Deprecate EntityArrays constructor for removal.
    + Deprecate ObjectToStringComparator constructor for removal.
    + Deprecate RuntimeEnvironment constructor for removal.
- Includes changes from 3.15.0:
  * New features:
    + Customize text pattern in DiffResult#toString(). Fixes
    LANG-1724.
    + Add DiffBuilder.Builder.
    + Add DiffBuilder.builder().
    + Add ReflectionDiffBuilder.Builder.
    + Add ReflectionDiffBuilder.builder().
    + Add test in TypeUtilsTest #1151.
    + Add Streams.failableStream(T), non-varargs variant.
    + Add Streams.nonNull(T), non-varargs variant.
    + Add ArrayUtils.nullTo(T[], T[]).
    + Add T ArrayUtils.arraycopy(T, int, T, int, int) fluent style.
    + Add T ArrayUtils.arraycopy(T, int, int, int, Function) fluent
    style.
    + Add SystemUtils.IS_JAVA_22.
    + Add JavaVersion.JAVA_22.
    + Add SystemProperties.getUserName(Supplier&lt;String&gt;).
    + Add SystemProperties.getLineSeparator(Supplier&lt;String&gt;).
    + Add
    + SystemProperties.getJavaSpecificationVersion(Supplier&lt;String&gt;).
    + Add SystemProperties constants and methods for system
    properties as of Java 22.
    + Add MethodUtils.getMethodObject(Class, String, Class...).
    + Add null-safe Consumers.accept() and Functions.apply() #1215.
    Fixes LANG-1733.
    + Add SystemUtils.IS_OS_ANDROID.
    + Add SystemUtils.IS_OS_MAC_OSX_SONOMA.
    + Add RuntimeEnvironment.inContainer() #1241.
    + Add AppendableJoiner and refactor string joining #1244.
  * Fixed bugs:
    + Improve Javadoc in ExceptionUtils #1136.
    + Fixed two non-deterministic tests in EnumUtilsTest.java
    [#1131].
    + Fix wrong number check that cause
    StringIndexOutOfBoundsException #1140. Fixes LANG-1721.
    + Rethrow NegativeArraySizeException as SerializationException
    in SerializationUtils.deserialize(InputStream) #1141. Fixes
    LANG-1722.
    + Throw NumberFormatException instead of
    IndexOutOfBoundsException in NumberUtils.getMantissa(String,
    int) #1145. Fixes LANG-1723.
    + Minor grammar fixes #1143.
    + ArrayUtils will return null when adding two null arrays, but
    undocumented. Fixes LANG-1713.
    + Let parent POM figure out commons.spdx.version.
    + Undeprecate ExceptionUtils.rethrow(Throwable). Fixes
    LANG-1726.
    + Test the Conversion class #1155. Fixes LANG-1702.
    + Address minor redundancies after code inspection #1148.
    + Allow EventListenerSupport to handle (and ignore) exception
    from listeners allowing invocation of all listeners #1167.
    + Deprecate AnnotationUtils 0-argument constructor.
    + Deprecate ArchUtils 0-argument constructor.
    + Deprecate ArrayUtils 0-argument constructor.
    + Deprecate BooleanUtils 0-argument constructor.
    + Deprecate CharSequenceUtils 0-argument constructor.
    + Deprecate CharSetUtils 0-argument constructor.
    + Deprecate CharUtils 0-argument constructor.
    + Deprecate ClassLoaderUtils 0-argument constructor.
    + Deprecate ClassPathUtils 0-argument constructor.
    + Deprecate ClassUtils 0-argument constructor.
    + Deprecate ConstructorUtils 0-argument constructor.
    + Deprecate DateFormatUtils 0-argument constructor.
    + Deprecate DateUtils 0-argument constructor.
    + Deprecate Diff.getType().
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle).
    + Deprecate DiffBuilder.DiffBuilder(T, T, ToStringStyle,
    boolean).
    + Deprecate DurationFormatUtils 0-argument constructor.
    + Deprecate DurationUtils 0-argument constructor.
    + Deprecate EnumUtils 0-argument constructor.
    + Deprecate EventUtils 0-argument constructor.
    + Deprecate FieldUtils 0-argument constructor.
    + Deprecate IEEE754rUtils 0-argument constructor.
    + Deprecate InheritanceUtils 0-argument constructor.
    + Deprecate IntStreams 0-argument constructor.
    + Deprecate LocaleUtils 0-argument constructor.
    + Deprecate LockingVisitors 0-argument constructor.
    + Deprecate MemberUtils 0-argument constructor.
    + Deprecate MethodUtils 0-argument constructor.
    + Deprecate NumberUtils 0-argument constructor.
    + Deprecate ObjectUtils 0-argument constructor.
    + Deprecate RandomStringUtils 0-argument constructor.
    + Deprecate RandomUtils 0-argument constructor.
    + Deprecate ReflectionDiffBuilder.ReflectionDiffBuilder(T, T,
    ToStringStyle).
    + Deprecate RegExUtils 0-argument constructor.
    + Deprecate SerializationUtils 0-argument constructor.
    + Deprecate Streams 0-argument constructor.
    + Deprecate StringEscapeUtils 0-argument constructor.
    + Deprecate StringUtils 0-argument constructor.
    + Deprecate Suppliers 0-argument constructor.
    + Deprecate SystemProperties 0-argument constructor.
    + Deprecate ThreadUtils 0-argument constructor.
    + Deprecate TypeUtils 0-argument constructor.
    + Make ArrayFill null-safe.
    + Make ArraySorter null-safe.
    + Make ArrayUtils.removeAll() null-safe.
    + Fix Java version in README.md #1170.
    + StringUtils.stripAccents() should handle ligatures, UTF32
    math blocks, etc. #1201.
    + TypeUtils.toString(Type) StackOverflowError for an inner
    class in the inner class parameterized enclosing class #657.
    Fixes LANG-1524.
    + Deprecate SystemUtils.getUserName(String) in favor of
    SystemProperties.getUserName(Supplier).
    + Make LockVisitor.acceptReadLocked(FailableConsumer)
    null-safe.
    + Make LockVisitor.applyWriteLocked(FailableConsumer)
    null-safe.
    + Make ObjectUtils.getFirstNonNull(Supplier...) null-safe.
    + Make SystemProperties.getLineSeparator(Supplier).
    + StringUtils.stripAccents(String) doesn't handle "\u0111" and
    "\u0110" (Vietnamese) #1216.
    + StringUtils.stripAccents(String) doesn't handle I with bar.
    + StringUtils.stripAccents(String) doesn't handle U with bar.
    + StringUtils.stripAccents(String) doesn't handle T with
    stroke.
    + Fix Javadoc for FluentBitSet.setInclusive(int, int) #1222.
    Fixes LANG-1735.
    + Same Javadoc changes as [TEXT-234] #1223.
    + Remove duplicate static data in
    SerializationUtils.ClassLoaderAwareObjectInputStream.
    + Reimplement RandomUtils and RandomStringUtils on top of
    SecureRandom#getInstanceStrong() #1235.
    + DiffBuilder: Type constraint for method append(...,
    DiffResult) too strict #786. Fixes LANG-1657.</changelog>
</package>
<package pkgid="1c7f1894322a69243a2dc01f643a13bbe9321b970a8534e400244845b4c3da3c" name="apache-commons-logging" arch="noarch">
  <version epoch="0" ver="1.3.4" rel="150200.11.9.1"/>
  <changelog author="tchvatal@suse.com" date="1425470400">- Use log4j-mini to hopefully avoid build-cycle</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg offline and rely on service</changelog>
  <changelog author="tchvatal@suse.com" date="1427284801">- Drop maven conditionals that were never triggered.</changelog>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Update to version 1.2
  see http://commons.apache.org/proper/commons-logging/changes-report.html
  or RELEASE-NOTES.txt for details</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires</changelog>
  <changelog author="tchvatal@suse.com" date="1495195201">- Remove bootstrap conditional</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Added patch:
  * commons-logging-1.2-sourcetarget.patch
  - set java source and target versions to 1.6 in order to allow
    build with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * commons-logging-1.2-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1539950400">- Cleanup of maven pom files installation</changelog>
  <changelog author="fstrba@suse.com" date="1548676800">- Added patch:
  * commons-logging-manifests.patch
    + Different Bundle-SymbolicName for different jars</changelog>
  <changelog author="fstrba@suse.com" date="1549454400">- Build against glassfish-servlet-api</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven
- Use the pom.xml distributed with the package instead of
  downloading the same file as a separate source</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility log4j12-mini package</changelog>
  <changelog author="fstrba@suse.com" date="1616587200">- Added patch
  * no-tests.patch
    + ignore failing tests for arm6</changelog>
  <changelog author="fstrba@suse.com" date="1627473600">- Disable tests everywhere, not only for arm6</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Upgrade to 1.3.3
  * Bug Fixes:
    + * LOGGING-193: Update Log4j 2 OSGi imports #268.
    + * Fix PMD UnnecessaryFullyQualifiedName in SimpleLog.
    + * Fix NullPointerException in SimpleLog#write(Object) on null
    input.
    + Fix NullPointerException in SimpleLog#write(StringBuffer) on
    null input.
- Includes changes from 1.3.2
  * Fixed Bugs
    + LOGGING-190: Add OSGi metadata to enable Service Loader
    Mediator #234.
    + LOGGING-191: Apache commons logging shows 1.4 as latest
    release instead of 1.3.1.
    + Deprecate
    org.apache.commons.logging.LogSource.jdk14IsAvailable.
- Includes changes from 1.3.1
  * New features
    + Add Maven property project.build.outputTimestamp for build
    reproducibility.
  * Fixed Bugs
    + Remove references to very old JDK and Commons Logging
    versions #201.
    + Update from Logj 1 to the Log4j 2 API compatibility layer
    [#231].
    + Allow Servlet 4 in OSGi environment #191.
    + Fix generics warnings #213.
    + LOGGING-189: Fix Import-Package entry for org.slf4j #188.
- Includes changes from 1.3.0
  * New Features:
    + Add support for Log4j API and SLF4J #177.
    + Deprecate org.apache.commons.logging.impl.WeakHashtable
    without replacement.  LOGGING-188: Deprecate and disable
    `Jdk13LumberjackLogger` and `Log4JLogger`.  LOGGING-173:
    + Deprecate and disable `AvalonLogger` and `LogKitLogger`.
    + LOGGING-165: Add Automatic-Module-Name Manifest Header for
    Java 9 compatibility.
  * Fixed Bugs:
    + LOGGING-163: BufferedReader is not closed properly.
    + LOGGING-177: Remove redundant initializer #46
    + Use a weak reference for the cached class loader #71.
    + Add more entries to .gitignore file #25.
    + Minor Improvements #34.
    + [StepSecurity] ci: Harden GitHub Actions #145.
    + LOGGING-185: Replace custom code with `ServiceLoader` call.
    + Fix possible NPEs in LogFactoryImpl.
    + LOGGING-185: Fix failing tests #180.
    + Deprecate LogConfigurationException.cause in favor of
    getCause().
    + Fix SpotBugs [ERROR] High: Found reliance on default encoding
    in org.apache.commons.logging.LogFactory.initDiagnostics():
    new java.io.PrintStream(OutputStream)
    [org.apache.commons.logging.LogFactory] At
    LogFactory.java:[line 1205] DM_DEFAULT_ENCODING.
    + Fix SpotBugs [ERROR] Medium: Class
    org.apache.commons.logging.impl.WeakHashtable defines
    non-transient non-serializable instance field queue
    [org.apache.commons.logging.impl.WeakHashtable] In
    WeakHashtable.java SE_BAD_FIELD.
    + Set java.logging as optional module #183.
    + Fix SpotBugs [ERROR] Medium: Switch statement found in
    org.apache.commons.logging.impl.SimpleLog.log(int, Object,
    Throwable) where default case is missing
    [org.apache.commons.logging.impl.SimpleLog] At
    SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT.
    + Deprecate
    org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel
    without replacement.
- Remove deprecated patch files:
  * commons-logging-1.1.3-src-junit.diff
  * commons-logging-1.2-sourcetarget.patch
  * commons-logging-manifests.patch
  * no-tests.patch
- Reinstate ant build (removed upstream)
  * add build.xml
  * add build.properties
- Remove unnecessary dependencies
  * add commons-logging-1.3.3-dependencies.patch
- Add upstream dev's public key to apache-commons-logging.keyring</changelog>
  <changelog author="fstrba@suse.com" date="1730203200">- Upgrade to 1.3.4
  * Bug fix:
    + LOGGING-192: Fix factory loading from context class
    loader #280, #281.</changelog>
</package>
<package pkgid="aa25aafa78dbe78ed3251d86aa73f8c1cae74691f752b4e2d755aa0d7deb9e51" name="apache-commons-logging" arch="src">
  <version epoch="0" ver="1.3.4" rel="150200.11.9.1"/>
  <changelog author="tchvatal@suse.com" date="1425470400">- Use log4j-mini to hopefully avoid build-cycle</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1427284800">- Drop gpg offline and rely on service</changelog>
  <changelog author="tchvatal@suse.com" date="1427284801">- Drop maven conditionals that were never triggered.</changelog>
  <changelog author="p.drouand@gmail.com" date="1453636800">- Update to version 1.2
  see http://commons.apache.org/proper/commons-logging/changes-report.html
  or RELEASE-NOTES.txt for details</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires</changelog>
  <changelog author="tchvatal@suse.com" date="1495195201">- Remove bootstrap conditional</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Added patch:
  * commons-logging-1.2-sourcetarget.patch
  - set java source and target versions to 1.6 in order to allow
    build with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Modified patch:
  * commons-logging-1.2-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1539950400">- Cleanup of maven pom files installation</changelog>
  <changelog author="fstrba@suse.com" date="1548676800">- Added patch:
  * commons-logging-manifests.patch
    + Different Bundle-SymbolicName for different jars</changelog>
  <changelog author="fstrba@suse.com" date="1549454400">- Build against glassfish-servlet-api</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven
- Use the pom.xml distributed with the package instead of
  downloading the same file as a separate source</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility log4j12-mini package</changelog>
  <changelog author="fstrba@suse.com" date="1616587200">- Added patch
  * no-tests.patch
    + ignore failing tests for arm6</changelog>
  <changelog author="fstrba@suse.com" date="1627473600">- Disable tests everywhere, not only for arm6</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="gus.kenion@suse.com" date="1723204800">- Upgrade to 1.3.3
  * Bug Fixes:
    + * LOGGING-193: Update Log4j 2 OSGi imports #268.
    + * Fix PMD UnnecessaryFullyQualifiedName in SimpleLog.
    + * Fix NullPointerException in SimpleLog#write(Object) on null
    input.
    + Fix NullPointerException in SimpleLog#write(StringBuffer) on
    null input.
- Includes changes from 1.3.2
  * Fixed Bugs
    + LOGGING-190: Add OSGi metadata to enable Service Loader
    Mediator #234.
    + LOGGING-191: Apache commons logging shows 1.4 as latest
    release instead of 1.3.1.
    + Deprecate
    org.apache.commons.logging.LogSource.jdk14IsAvailable.
- Includes changes from 1.3.1
  * New features
    + Add Maven property project.build.outputTimestamp for build
    reproducibility.
  * Fixed Bugs
    + Remove references to very old JDK and Commons Logging
    versions #201.
    + Update from Logj 1 to the Log4j 2 API compatibility layer
    [#231].
    + Allow Servlet 4 in OSGi environment #191.
    + Fix generics warnings #213.
    + LOGGING-189: Fix Import-Package entry for org.slf4j #188.
- Includes changes from 1.3.0
  * New Features:
    + Add support for Log4j API and SLF4J #177.
    + Deprecate org.apache.commons.logging.impl.WeakHashtable
    without replacement.  LOGGING-188: Deprecate and disable
    `Jdk13LumberjackLogger` and `Log4JLogger`.  LOGGING-173:
    + Deprecate and disable `AvalonLogger` and `LogKitLogger`.
    + LOGGING-165: Add Automatic-Module-Name Manifest Header for
    Java 9 compatibility.
  * Fixed Bugs:
    + LOGGING-163: BufferedReader is not closed properly.
    + LOGGING-177: Remove redundant initializer #46
    + Use a weak reference for the cached class loader #71.
    + Add more entries to .gitignore file #25.
    + Minor Improvements #34.
    + [StepSecurity] ci: Harden GitHub Actions #145.
    + LOGGING-185: Replace custom code with `ServiceLoader` call.
    + Fix possible NPEs in LogFactoryImpl.
    + LOGGING-185: Fix failing tests #180.
    + Deprecate LogConfigurationException.cause in favor of
    getCause().
    + Fix SpotBugs [ERROR] High: Found reliance on default encoding
    in org.apache.commons.logging.LogFactory.initDiagnostics():
    new java.io.PrintStream(OutputStream)
    [org.apache.commons.logging.LogFactory] At
    LogFactory.java:[line 1205] DM_DEFAULT_ENCODING.
    + Fix SpotBugs [ERROR] Medium: Class
    org.apache.commons.logging.impl.WeakHashtable defines
    non-transient non-serializable instance field queue
    [org.apache.commons.logging.impl.WeakHashtable] In
    WeakHashtable.java SE_BAD_FIELD.
    + Set java.logging as optional module #183.
    + Fix SpotBugs [ERROR] Medium: Switch statement found in
    org.apache.commons.logging.impl.SimpleLog.log(int, Object,
    Throwable) where default case is missing
    [org.apache.commons.logging.impl.SimpleLog] At
    SimpleLog.java:[lines 505-522] SF_SWITCH_NO_DEFAULT.
    + Deprecate
    org.apache.commons.logging.impl.Jdk13LumberjackLogger.dummyLevel
    without replacement.
- Remove deprecated patch files:
  * commons-logging-1.1.3-src-junit.diff
  * commons-logging-1.2-sourcetarget.patch
  * commons-logging-manifests.patch
  * no-tests.patch
- Reinstate ant build (removed upstream)
  * add build.xml
  * add build.properties
- Remove unnecessary dependencies
  * add commons-logging-1.3.3-dependencies.patch
- Add upstream dev's public key to apache-commons-logging.keyring</changelog>
  <changelog author="fstrba@suse.com" date="1730203200">- Upgrade to 1.3.4
  * Bug fix:
    + LOGGING-192: Fix factory loading from context class
    loader #280, #281.</changelog>
</package>
<package pkgid="895d8e9d547bc7a1e48ee637b6cb3b6215e83aa8d2e8e520cc3f16041167fd16" name="apache-commons-text" arch="noarch">
  <version epoch="0" ver="1.10.0" rel="150200.5.11.1"/>
  <changelog author="idonmez@suse.com" date="1561464000">- Initial release v1.6 on OBS</changelog>
  <changelog author="fstrba@suse.com" date="1573300800">- Upgrade to upstream version 1.8</changelog>
  <changelog author="fstrba@suse.com" date="1646913600">- Rewrite build system to build with ant in order to avoid build
  cycles.
  * This package is now the dependency of maven-javadoc-plugin</changelog>
  <changelog author="fstrba@suse.com" date="1665748800">- Upgrade to version 1.10.0 (mitigation of bsc#1204284,
  CVE-2022-42889)
  * Changes of 1.10.0:
    + Fix CaseUtils when the input string contains only delimiters
    + Add GraalVM test dependencies to fix test failures with Java
    15
    + Incorrect values for Jaccard similarity with empty strings
    + StringSubstitutor map constructor throws NPE on 1.9 with null
    map
    + JaroWinklerDistance returns the same values as
    JaroWinklerSimilarity
    + Correct Javadoc in FileStringLookup
    + Use StringUtils.INDEX_NOT_FOUND constant
    + Remove redundant local variable
    + Replace lambda with method reference
    + Simplify statements
    + Replace statement lambda with expression lambda
    + Use static class inner class in tests
    + Simplify assertion
    + Extract duplicate code
    + Set void return method
    + Remove unused exception from
    TextStringBuilder.readFrom(CharBuffer). This preserves binary
    compatibility but not source compatibility
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows
    + TextStringBuilder.TextStringBuilderReader.skip(long): Throw
    an exception when an implicit narrowing conversion in a
    compound assignment would result in information loss or a
    numeric error such as an overflows
    + TextStringBuilder.equals whatever the capacity is
    + A More Efficient Implementation for Calculating Size of
    Longest Common Subsequence
    + LookupTranslator returns count of chars consumed, not of
    codepoints consumed
    + Use Math.min() call instead of doing it manually
    + TextStringBuilder: Throw OutOfMemoryError instead of
    NegativeArraySizeException
    + TextStringBuilder: Can't grow to sizes up to
    Integer.MAX_VALUE
    + Make default string lookups configurable via system property
    Remove dns, url, and script lookups from defaults. If these
    lookups are required for use in StringSubstitutor
    .createInterpolator(), they must be enabled via system
    property (bsc#
    + Add DoubleFormat utility
    + Document negative limit for WordUtils abbreviate method
    + Speed up LevenshteinDistance with threshold by exiting early
    + Release Notes page hasn't been updated for 1.9 release yet
    + Add StrBuilder.isNotEmpty()
  * Changes of 1.9:
    + Removed non-existing parameter from Javadocs and spelled out
    parameters in throws
    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin
    and end of string
    + ScriptStringLookup does not accept ":"
    + StringSubstitutor incorrectly removes some escape characters
    + Make ConstantStringLookup.constantCache final
    + Simplify if in CaseUtils
    + Add StringMatcher.size()
    + Refactor TextStringBuilder.readFrom(Readable), extracting
    readFrom(CharBuffer) and readFrom(Reader)
    + Add BiStringLookup and implementation BiFunctionStringLookup
    + Add org.apache.commons.text.StringSubstitutor
    .StringSubstitutor(StringSubstitutor)
    + Add org.apache.commons.text.TextStringBuilder
    .TextStringBuilder(CharSequence)
    + Add org.apache.commons.text.TextStringBuilder.drainChar(int)
    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,
    int, char[]. int)
    + Add org.apache.commons.text.TextStringBuilder.isNotEmpty()
    + Add org.apache.commons.text.TextStringBuilder.isReallocated()
    + Add org.apache.commons.text.TextStringBuilder.readFrom(Reader,
    int)
    + Add org.apache.commons.text.TextStringBuilder.set(String)
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[])
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],
    int)
    + Add org.apache.commons.text.io.StringSubstitutorReader
    + Add org.apache.commons.text.lookup.StringLookupFactory
    .functionStringLookup(Function&lt;String, V&gt;)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int, int, int)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .andMatcher(StringMatcher...)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .stringMatcher(char...)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1667217600">- add upstream signing key and verify source signature</changelog>
</package>
<package pkgid="fd07f34b42a64253ad6b6ee1018dde3810845991fc2b0670ed256dba930773f1" name="apache-commons-text" arch="src">
  <version epoch="0" ver="1.10.0" rel="150200.5.11.1"/>
  <changelog author="idonmez@suse.com" date="1561464000">- Initial release v1.6 on OBS</changelog>
  <changelog author="fstrba@suse.com" date="1573300800">- Upgrade to upstream version 1.8</changelog>
  <changelog author="fstrba@suse.com" date="1646913600">- Rewrite build system to build with ant in order to avoid build
  cycles.
  * This package is now the dependency of maven-javadoc-plugin</changelog>
  <changelog author="fstrba@suse.com" date="1665748800">- Upgrade to version 1.10.0 (mitigation of bsc#1204284,
  CVE-2022-42889)
  * Changes of 1.10.0:
    + Fix CaseUtils when the input string contains only delimiters
    + Add GraalVM test dependencies to fix test failures with Java
    15
    + Incorrect values for Jaccard similarity with empty strings
    + StringSubstitutor map constructor throws NPE on 1.9 with null
    map
    + JaroWinklerDistance returns the same values as
    JaroWinklerSimilarity
    + Correct Javadoc in FileStringLookup
    + Use StringUtils.INDEX_NOT_FOUND constant
    + Remove redundant local variable
    + Replace lambda with method reference
    + Simplify statements
    + Replace statement lambda with expression lambda
    + Use static class inner class in tests
    + Simplify assertion
    + Extract duplicate code
    + Set void return method
    + Remove unused exception from
    TextStringBuilder.readFrom(CharBuffer). This preserves binary
    compatibility but not source compatibility
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows
    + TextStringBuilder.TextStringBuilderReader.skip(long): Throw
    an exception when an implicit narrowing conversion in a
    compound assignment would result in information loss or a
    numeric error such as an overflows
    + TextStringBuilder.equals whatever the capacity is
    + A More Efficient Implementation for Calculating Size of
    Longest Common Subsequence
    + LookupTranslator returns count of chars consumed, not of
    codepoints consumed
    + Use Math.min() call instead of doing it manually
    + TextStringBuilder: Throw OutOfMemoryError instead of
    NegativeArraySizeException
    + TextStringBuilder: Can't grow to sizes up to
    Integer.MAX_VALUE
    + Make default string lookups configurable via system property
    Remove dns, url, and script lookups from defaults. If these
    lookups are required for use in StringSubstitutor
    .createInterpolator(), they must be enabled via system
    property (bsc#
    + Add DoubleFormat utility
    + Document negative limit for WordUtils abbreviate method
    + Speed up LevenshteinDistance with threshold by exiting early
    + Release Notes page hasn't been updated for 1.9 release yet
    + Add StrBuilder.isNotEmpty()
  * Changes of 1.9:
    + Removed non-existing parameter from Javadocs and spelled out
    parameters in throws
    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin
    and end of string
    + ScriptStringLookup does not accept ":"
    + StringSubstitutor incorrectly removes some escape characters
    + Make ConstantStringLookup.constantCache final
    + Simplify if in CaseUtils
    + Add StringMatcher.size()
    + Refactor TextStringBuilder.readFrom(Readable), extracting
    readFrom(CharBuffer) and readFrom(Reader)
    + Add BiStringLookup and implementation BiFunctionStringLookup
    + Add org.apache.commons.text.StringSubstitutor
    .StringSubstitutor(StringSubstitutor)
    + Add org.apache.commons.text.TextStringBuilder
    .TextStringBuilder(CharSequence)
    + Add org.apache.commons.text.TextStringBuilder.drainChar(int)
    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,
    int, char[]. int)
    + Add org.apache.commons.text.TextStringBuilder.isNotEmpty()
    + Add org.apache.commons.text.TextStringBuilder.isReallocated()
    + Add org.apache.commons.text.TextStringBuilder.readFrom(Reader,
    int)
    + Add org.apache.commons.text.TextStringBuilder.set(String)
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[])
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],
    int)
    + Add org.apache.commons.text.io.StringSubstitutorReader
    + Add org.apache.commons.text.lookup.StringLookupFactory
    .functionStringLookup(Function&lt;String, V&gt;)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int, int, int)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .andMatcher(StringMatcher...)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .stringMatcher(char...)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1667217600">- add upstream signing key and verify source signature</changelog>
</package>
<package pkgid="ed13fb1769c64679a88c410c71a294ab47cda5bb962e0390706ce736dfd6da98" name="apache-commons-text-javadoc" arch="noarch">
  <version epoch="0" ver="1.10.0" rel="150200.5.11.1"/>
  <changelog author="idonmez@suse.com" date="1561464000">- Initial release v1.6 on OBS</changelog>
  <changelog author="fstrba@suse.com" date="1573300800">- Upgrade to upstream version 1.8</changelog>
  <changelog author="fstrba@suse.com" date="1646913600">- Rewrite build system to build with ant in order to avoid build
  cycles.
  * This package is now the dependency of maven-javadoc-plugin</changelog>
  <changelog author="fstrba@suse.com" date="1665748800">- Upgrade to version 1.10.0 (mitigation of bsc#1204284,
  CVE-2022-42889)
  * Changes of 1.10.0:
    + Fix CaseUtils when the input string contains only delimiters
    + Add GraalVM test dependencies to fix test failures with Java
    15
    + Incorrect values for Jaccard similarity with empty strings
    + StringSubstitutor map constructor throws NPE on 1.9 with null
    map
    + JaroWinklerDistance returns the same values as
    JaroWinklerSimilarity
    + Correct Javadoc in FileStringLookup
    + Use StringUtils.INDEX_NOT_FOUND constant
    + Remove redundant local variable
    + Replace lambda with method reference
    + Simplify statements
    + Replace statement lambda with expression lambda
    + Use static class inner class in tests
    + Simplify assertion
    + Extract duplicate code
    + Set void return method
    + Remove unused exception from
    TextStringBuilder.readFrom(CharBuffer). This preserves binary
    compatibility but not source compatibility
    + StrBuilder.StrBuilderReader.skip(long): Throw an exception
    when an implicit narrowing conversion in a compound assignment
    would result in information loss or a numeric error such as an
    overflows
    + TextStringBuilder.TextStringBuilderReader.skip(long): Throw
    an exception when an implicit narrowing conversion in a
    compound assignment would result in information loss or a
    numeric error such as an overflows
    + TextStringBuilder.equals whatever the capacity is
    + A More Efficient Implementation for Calculating Size of
    Longest Common Subsequence
    + LookupTranslator returns count of chars consumed, not of
    codepoints consumed
    + Use Math.min() call instead of doing it manually
    + TextStringBuilder: Throw OutOfMemoryError instead of
    NegativeArraySizeException
    + TextStringBuilder: Can't grow to sizes up to
    Integer.MAX_VALUE
    + Make default string lookups configurable via system property
    Remove dns, url, and script lookups from defaults. If these
    lookups are required for use in StringSubstitutor
    .createInterpolator(), they must be enabled via system
    property (bsc#
    + Add DoubleFormat utility
    + Document negative limit for WordUtils abbreviate method
    + Speed up LevenshteinDistance with threshold by exiting early
    + Release Notes page hasn't been updated for 1.9 release yet
    + Add StrBuilder.isNotEmpty()
  * Changes of 1.9:
    + Removed non-existing parameter from Javadocs and spelled out
    parameters in throws
    + StringEscapeUtils.unescapeCsv doesn't remove quotes at begin
    and end of string
    + ScriptStringLookup does not accept ":"
    + StringSubstitutor incorrectly removes some escape characters
    + Make ConstantStringLookup.constantCache final
    + Simplify if in CaseUtils
    + Add StringMatcher.size()
    + Refactor TextStringBuilder.readFrom(Readable), extracting
    readFrom(CharBuffer) and readFrom(Reader)
    + Add BiStringLookup and implementation BiFunctionStringLookup
    + Add org.apache.commons.text.StringSubstitutor
    .StringSubstitutor(StringSubstitutor)
    + Add org.apache.commons.text.TextStringBuilder
    .TextStringBuilder(CharSequence)
    + Add org.apache.commons.text.TextStringBuilder.drainChar(int)
    + Add org.apache.commons.text.TextStringBuilder.drainChars(int,
    int, char[]. int)
    + Add org.apache.commons.text.TextStringBuilder.isNotEmpty()
    + Add org.apache.commons.text.TextStringBuilder.isReallocated()
    + Add org.apache.commons.text.TextStringBuilder.readFrom(Reader,
    int)
    + Add org.apache.commons.text.TextStringBuilder.set(String)
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[])
    + Add org.apache.commons.text.TextStringBuilder.wrap(char[],
    int)
    + Add org.apache.commons.text.io.StringSubstitutorReader
    + Add org.apache.commons.text.lookup.StringLookupFactory
    .functionStringLookup(Function&lt;String, V&gt;)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int)
    + Add org.apache.commons.text.matcher.StringMatcher
    .isMatch(CharSequence, int, int, int)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .andMatcher(StringMatcher...)
    + Add org.apache.commons.text.matcher.StringMatcherFactory
    .stringMatcher(char...)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1667217600">- add upstream signing key and verify source signature</changelog>
</package>
<package pkgid="c09d1383d12cfe023af3ad9b6e5d7aca3b5cdb76b12f3f97d32c24bb9cb3f706" name="apache-commons-vfs2" arch="noarch">
  <version epoch="0" ver="2.10.0" rel="150200.3.3.1"/>
  <changelog author="fstrba@suse.com" date="1551700800">- Intial packaging of apache-commons-vfs2 2.2
- Generate and customize ant build system</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1742904000">- Upgrade to upstream version 2.10.0
  * Fixes bsc#1239973, CVE-2025-27553: Possible path traversal
    issue when using NameScope.DESCENDENT
  * Fixes bsc#1239974, CVE-2025-30474: Failing to find an FTP file
    can reveal the URI's password in an error message
  * For detailed list of all changes, see RELEASE-NOTES.txt file
    distributed with the package</changelog>
</package>
<package pkgid="0e4c4ef51075b1e4b381fb62c1f516345d5f9e7bf84b0804b7a1192a1bdc9a85" name="apache-commons-vfs2" arch="src">
  <version epoch="0" ver="2.10.0" rel="150200.3.3.1"/>
  <changelog author="fstrba@suse.com" date="1551700800">- Intial packaging of apache-commons-vfs2 2.2
- Generate and customize ant build system</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1742904000">- Upgrade to upstream version 2.10.0
  * Fixes bsc#1239973, CVE-2025-27553: Possible path traversal
    issue when using NameScope.DESCENDENT
  * Fixes bsc#1239974, CVE-2025-30474: Failing to find an FTP file
    can reveal the URI's password in an error message
  * For detailed list of all changes, see RELEASE-NOTES.txt file
    distributed with the package</changelog>
</package>
<package pkgid="8a06c1884a46ae62add504f8a7546609ca57b210cd3988f2916c678789740b61" name="apache-commons-vfs2-ant" arch="noarch">
  <version epoch="0" ver="2.10.0" rel="150200.3.3.1"/>
  <changelog author="fstrba@suse.com" date="1551700800">- Intial packaging of apache-commons-vfs2 2.2
- Generate and customize ant build system</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1742904000">- Upgrade to upstream version 2.10.0
  * Fixes bsc#1239973, CVE-2025-27553: Possible path traversal
    issue when using NameScope.DESCENDENT
  * Fixes bsc#1239974, CVE-2025-30474: Failing to find an FTP file
    can reveal the URI's password in an error message
  * For detailed list of all changes, see RELEASE-NOTES.txt file
    distributed with the package</changelog>
</package>
<package pkgid="fd628ca1978cdf74c59c152e303bbf154e3985aa34df9b73acbc07c2915396a6" name="apache-commons-vfs2-examples" arch="noarch">
  <version epoch="0" ver="2.10.0" rel="150200.3.3.1"/>
  <changelog author="fstrba@suse.com" date="1551700800">- Intial packaging of apache-commons-vfs2 2.2
- Generate and customize ant build system</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1742904000">- Upgrade to upstream version 2.10.0
  * Fixes bsc#1239973, CVE-2025-27553: Possible path traversal
    issue when using NameScope.DESCENDENT
  * Fixes bsc#1239974, CVE-2025-30474: Failing to find an FTP file
    can reveal the URI's password in an error message
  * For detailed list of all changes, see RELEASE-NOTES.txt file
    distributed with the package</changelog>
</package>
<package pkgid="153d29ec01b984c758d812bc73713a6ff127d52881529a3574450bc554e0878f" name="apache-commons-vfs2-javadoc" arch="noarch">
  <version epoch="0" ver="2.10.0" rel="150200.3.3.1"/>
  <changelog author="fstrba@suse.com" date="1551700800">- Intial packaging of apache-commons-vfs2 2.2
- Generate and customize ant build system</changelog>
  <changelog author="fstrba@suse.com" date="1698235200">- Build with source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1727870400">- Spec file cleanup</changelog>
  <changelog author="fstrba@suse.com" date="1742904000">- Upgrade to upstream version 2.10.0
  * Fixes bsc#1239973, CVE-2025-27553: Possible path traversal
    issue when using NameScope.DESCENDENT
  * Fixes bsc#1239974, CVE-2025-30474: Failing to find an FTP file
    can reveal the URI's password in an error message
  * For detailed list of all changes, see RELEASE-NOTES.txt file
    distributed with the package</changelog>
</package>
<package pkgid="1377b208c1805864516cf236f88fb9d8ba0650dfa63e88818465e935a8815d13" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e367c4f3e0908b65eacbe2dd34484b340e5c8749adc745421a503db8011a071b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="6810567cc9e19a888eadc152e0070f47a83b9abae7ebd8c94e44fc23a06e4a1e" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="06c5e81f4d4a6a03b22cf864293f063b8c0ea7e792db86a5a0458dfc7f198906" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e9df642b4b857f38aee120996fda71c251e49d0b1a5246e52e1bbccbea8d1c78" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="393f2b100c4cd0e5e688cf3ad185701a876e4efb7194de95280360378dc51374" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="27feb29002eda4d9ade288e76ab90e97bc6165a1d53974d741c0fed82b178f9d" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2b43dfb47ca16c7e2e2100d41035b3469a36be6333f0a2617d2d01d70d362a5b" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="71278026010f998bca2e5311836a518e03e84f66915248c012d62e7e64666a54" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2f5b35ba68fa8a57a8a5354ce14dba2a09e2551d98dab365654273e39fc7d7f4" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="76b8b9ed7c05e25c47956f83f2e5161c27cb6ef32ce4b6c6d53d976cc4b1d6b1" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="684b589b4d9914c3d503bb169dc2c2d0f7cbfe76c87213dfd4226986ec3f8c27" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="565ad6f240581ca8a635c2b8d6a816d8a184e4223f43808982f5a3d8d68edd42" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="2a6e2fd1dc775831efb1eeee6cb4fb82e42aa3347fce2fd8f4fc25f9e9535539" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="54fc0f838e770caf9cfebd07e12b19b37b4cb8dd3e0c2e5166e4ee7d313628a1" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="aa3bc6e179a94415329822923f9021884761a5369884a12ac94a499c6809157c" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="6e4c4e48435d027be90dfb83d323adb3593210ffedcd1878528691d1c73f410b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="3b2a64f932e5eb92698e7cfa6eb29c4c4bb0f02ce738e7af8bb612b1d96ef773" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="8e4f6f952812f27801135ef3d87ed1b4bc7e00cd24a851736d9036c0453c78e3" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="3f79f129edc6d4be2d475dcb144725f9b35988a5b917c907b1de3801109cd109" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.26.1"/>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
</package>
<package pkgid="298dada7a0211e328024552f176b3af7ec61be5f744e1e70a1532b92668300ba" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="8973aab8d912b3d0ec1a06bd6c8b24f2fe9c6c8efc7dad20a29a640854c79b45" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1727956800">- Apply fix for CVE-2024-40725, bsc#1228097.
  Patch file added:
  * apache2-CVE-2024-40725.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1728043200">- provide /usr/sbin/apxs and /usr/sbin/apxs2 symlinks to
  /usr/bin/aspx [bsc#1227261]</changelog>
</package>
<package pkgid="0e6bf49982e660677f587b6947fd3e9982e96a668f9c7f5b7450b8addc149c0b" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.29.1"/>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed us